Japan's Takarakuji lottery site hit by suspected login attack

The operators suspect a "credential stuffing" attack. That is when attackers take email and password pairs leaked from other services and try them on a new site, hoping people reused them.

What information may have been seen in the Takarakuji breach?

The exposed details may include name, address, phone number and email address. Also possible: the type and amount of tickets bought and their win or loss history, plus profile pictures.

For payouts, the bank name, account holder and the first four digits of the account number may have been visible. So could the last four digits of a credit card number.

The operators have not said how many members are affected. Those who are will be told individually by email.

Has anyone lost money?

Not as far as the operators have found. As of November 11 they had confirmed no fraudulent ticket purchases and no cases where bank details were changed to collect winnings. They also say there is no sign anyone broke into the site's servers or database, and no confirmed leak of member data.

The advice is the familiar kind. Do not reuse a password across services, and do not type your email or password into suspicious emails or sites. Because the attack likely relies on reused passwords, changing a shared one elsewhere is worth doing too.