Lottery official website, third party access possible to member's winning and losing information -- List-type attack? - ITmedia NEWS

On November 11, prefectures and designated cities across the country selling lottery tickets announced that it is possible that a third party logged in to some members' accounts on the temporarily suspended "Lottery Official Website" and viewed member information including the results of purchased tickets. They mentioned the possibility of a "list-based attack," where a third party attempts to log in using email addresses and passwords obtained from outside. The member information that may have been viewed by a third party includes registered details such as name, address, phone number, and email address, as well as the history of purchased lottery tickets, including type, amount, and winning or losing status. In addition, the first four digits of the account number for the bank account receiving the prize money, the last four digits of credit card numbers, and profile images of registered users are also included. The number of affected cases has not been disclosed, and the relevant members will be contacted individually by email in the future. As of the same day, there have been no instances of unauthorized lottery purchases or prize money withdrawals through altered account information. There is no indication of intrusion into the official website's server or database, and no confirmation of data leaks. In light of the possibility of a list-based attack, they have called on users of the official lottery website and official app to avoid reusing passwords across other services and to be cautious about entering their email address or password into suspicious emails or websites. The official lottery website temporarily suspended its use from the 5th due to the confirmation of a problem where users' passwords might change unintentionally, and the official app also stopped its use by the 6th.