The IDs and passwords of about 18 million Internet users have been found on a computer server set up by a Tokyo company, which was found in November to have allegedly provided its relay server to parties in China for illegal access, the Metropolitan Police Department announced Friday. The total includes member information of 1.78 million people for Yahoo Japan, Rakuten, Twitter and other sites, and illegal accesses using stolen passwords were confirmed.
As damage such as the illegal use of rewards points has been incurred, the MPD is further investigating the case.
In an earlier case in 2014, the MPD found IDs and other information for 5.06 million individuals on a relay server set up by another company.
The number of victims in the recent case is more than three times as many as in the 2014 case, making it the largest information theft case ever in Japan.
The company in question is Nicchu Shinsei Corp. in Toshima Ward, Tokyo. The police exposed the company in November, and alleged that it had provided its customers in China with other people’s IDs to allow them illegal Internet access.
The company’s president and other staff were arrested and indicted.
Information for about 18 million Internet users was found on the server in the latest investigation.
On the server, an automatic program that illegally attempts website access and confirms the validity of IDs and passwords had been installed.
Due to this program, IDs and passwords of about 1.78 million people, who were members of 31 different websites, had been put on lists. In some cases, this included information such as the individuals’ names and their dates of birth.
Among the victims, 1.72 million, or more than 90 percent, were users of major Internet search engine Yahoo Japan.
The rest were users or customers of online shopping giant Rakuten, Twitter, Facebook, credit card company Mitsubishi UFJ NiCOS Co. and others.
The illegal accesses were conducted from June to November last year, and during the period, damage such as the illegal use of rewards points and sending messages to website members to lure them to a fraud site have been confirmed.
Suspecting that criminal groups in China have illicitly used the stolen IDs and passwords, the MPD has requested the operators of the websites to inform their users of the case and urge them to change passwords.
“We have already taken such measures as changing passwords,” said a spokesperson of Yahoo Japan.
The MPD’s investigations have revealed that Nicchu Shinsei’s server was used to illegally send money via the Internet banking systems of more than 10 financial institutions.
Most of the users apparently used a popular Chinese chat service as well. The police plan to question the service’s operator about users’ information via Interpol.
Source:https://the-japan-news.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
