Breaches and incidents
YMIRLINK (Cuenote email platform): library vulnerability let attackers export 51.6M recipient records from 49 customer systems
YMIRLINK said on 16 Oct staff found unauthorized access; its second report (26 Oct) says data was exported from 49 single-tenant Cuenote FC (bulk email)...
- Disclosed
- Verification
- Checked against a primary source
What happened
- YMIRLINK said on 16 Oct staff found unauthorized access; its second report (26 Oct) says data was exported from 49 single-tenant Cuenote FC (bulk email) systems, 51,628,280 records cumulative (address books, delivery logs, web sign-up records), with 16 systems still being counted, plus 190 customer-contact records in Cuenote BASE.
- Root cause per the company: a program/library vulnerability let attackers obtain support/QA staff credentials, plant malicious programs to dump databases, steal session data and log in to other systems; admin screens and APIs lacked IP restrictions in some environments, and access came from overseas IPs.
- No attacker named.
- Servers were isolated, the vulnerability patched, support/QA credentials removed from customer systems, IP restrictions applied, and the incident reported to the Tokyo Metropolitan Police, PPC and JIPDEC; spam spoofing Saison Card from info@cuenote.jp was observed.