Cyber Incident Victim: Kagoya
Date:
Dec 2016
Location:
Japan
Summary
A Japanese hosting provider suffered a security breach involving unauthorized access to customer data through an OS command injection attack exploiting a web interface vulnerability. The incident compromised personal information including names, addresses, contact details, account credentials, and payment card data for tens of thousands of customers, with claims suggesting stored credentials were unencrypted. Following internal detection, the company notified affected clients, reported the incident to law enforcement, and advised monitoring financial transactions for suspicious activity. The attack disrupted services, rendering the provider's website temporarily inaccessible during the aftermath.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Kagoya, a prominent Japanese web hosting provider, suffered a cybersecurity breach discovered in December 2016 through internal monitoring. The company notified customers via email that attackers had compromised personal and financial data from transactions processed between April 1, 2015, and September 21, 2016. Forensic analysis revealed hackers exploited an operating system command injection vulnerability in Kagoya's web interface, enabling unauthorized execution of server commands. This attack vector allowed threat actors to infiltrate databases containing sensitive customer records without proper sanitization of input fields. The stolen data included names, physical addresses, phone numbers, email addresses, account names, passwords, credit card numbers, and expiration dates. A user on an external web hosting forum alleged the compromised credentials were stored in plain text format, though Kagoya did not confirm this assertion in its communications.
The breach impacted 48,685 customers whose personal information was exposed, with 20,809 individuals having financial data specifically compromised. Kagoya promptly reported the incident to Japanese law enforcement authorities and advised affected customers to monitor credit card statements for fraudulent transactions. At the time of public disclosure, the company's website remained offline, disrupting services for its substantial user base ranked among Japan's top 4,000 sites. This incident followed two other major Japanese cybersecurity events in 2016: a coordinated ATM cash-out scheme that extracted $13 million from 1,400 machines and the Japan Pension Service breach affecting 1.25 million individuals. Kagoya's breach highlighted persistent vulnerabilities in web infrastructure security and the risks associated with insufficient data protection measures during financial transactions.