Security News > 2021 > December > Fujitsu pins Japanese govt data breach on stolen ProjectWEB accounts
Fujitsu says the attackers behind the May data breach used a vulnerability in the company's ProjectWEB information-sharing tool to steal accounts from legitimate users and access proprietary data belonging to multiple Japanese government agencies.
The National Cyber Security Center of Japan and the country's Ministry of Land, Infrastructure, Transport, and Tourism revealed at the time that the threat actors gained access to at least 76,000 email accounts during the ProjectWEB breach.
Today, the company announced that the breach investigation uncovered several security vulnerabilities the attackers could have used to gain access to ProjectWEB accounts.
As further discovered during an internal review, they gained unauthorized access by stealing legitimate users' ProjectWEB accounts which made it possible to blend in and evade detection.
"One of these was used to illegitimately obtain legitimate IDs and passwords to make unauthorized access to ProjectWEB in such a way that it appeared like an authorized user was accessing the tool through normal channels of authentication and communication," Fujitsu said.
Fujitsu is a Japanese multinational technology company with over 126,000 employees in more than 100 countries.
News URL
Related news
- Dutch Police: ‘State actor’ likely behind recent data breach (source)
- Comcast and Truist Bank customers caught up in FBCS data breach (source)
- Internet Archive hacked, data breach impacts 31 million users (source)
- Internet Archive data breach, defacement, and DDoS: Users’ data compromised (source)
- Fidelity Investments says data breach affects over 77,000 people (source)
- Fidelity Data Breach Exposes Data of Over 77,000 Customers (source)
- USDoD hacker behind National Public Data breach arrested in Brazil (source)
- Tech giant Nidec confirms data breach following ransomware attack (source)
- Insurance admin Landmark says data breach impacts 800,000 people (source)
- Henry Schein discloses data breach a year after ransomware attack (source)