Japan lottery site hack: 4,436 accounts hit after password reuse

How did the lottery site hack happen?

An announcement on 11 November pointed to a so-called list-type attack, also known as credential stuffing. Attackers take email and password pairs leaked from other services and try them on a new site, betting that people reuse them. The officials say there is no sign that the lottery site's servers or databases were breached, and no confirmed leak of member data.

What data could be seen?

Logged-in attackers could have viewed names, birth dates, gender, addresses, phone numbers and email addresses. Prize payout account details were also visible: bank name, the first four digits of the account number and the account holder's name. Other visible data included the last four digits of a credit card number, purchase history (lottery type, amount, win or lose) and profile pictures for those who set one.

So far, officials say they have confirmed no lottery purchases made through hijacked accounts and no prize money redirected by changing bank details.

What should users do?

Users are asked to reset their password, check their registered details and watch for suspicious emails and websites. Anyone who uses the same ID and password on other sites should change those too. Affected users are being contacted individually by email, and a help desk has been opened.