A third party may have logged into members' accounts on Japan's suspended lottery official site and viewed personal data including whether their tickets won, the prefectures and designated cities that sell lottery tickets said on November 11, ITmedia News reported.
The operators said the logins may have been a list-type attack, in which an attacker tries email addresses and passwords obtained elsewhere against a service. The site has been offline since November 5.
What may have been viewed
The data includes registered details such as name, address, phone number and email address. It also covers the type, amount and win-loss history of tickets purchased.
Also potentially exposed were the name of the financial institution holding the account that receives prize money, the account holder's name and the first four digits of the account number. The last four digits of credit card numbers and profile images were also in scope.
No purchases or payouts seen
The operators did not disclose how many members are affected. They will contact those concerned individually by email.
As of November 11, they had found no lottery purchases made through the unauthorized logins and no prize money collected by rewriting account details. They said they found no sign of intrusion into the site's servers or database and no confirmed leak of member data.
Because a list-type attack is suspected, users of the official site and app were urged not to reuse passwords across other services. They were also told not to enter email addresses or passwords on suspicious emails or sites.
Site already halted
The lottery official site was suspended from November 5 after users' passwords were found to change without their intent. The official app was stopped by November 6.