JTB Corp, one of Japan's largest travel agencies, announced that it suffered a data breach in which an unknown individual stole the personal information of more than 7,930,000 users.
According to security firm Cylance, the breach occurred after one of the company's employees opened a malicious Microsoft Word document that was received as an attachment in a spear-phishing email.
The attackers used PlugX and Elirks malware.
The document was “tied” to the PlugX (Korplug) malware, a remote access Trojan (RAT) that allowed the attacker to access the employee’s computer.
The spear-phishing email was effective because it appeared to be a request for a travel reservation from All Nippon Airways Co, one of Japan’s major airlines.
After infecting the employee’s computer with PlugX, the crooks installed the Elirks backdoor trojan that allowed them to steal any data they deemed important.
The details and timing of the attack fit neatly with findings by the Palo Alto Network, which last week revealed details of multiple cyberattacks against Japanese businesses using the PlugX and Erliks malware.
These attacks and malware were linked to Chinese threat actors.
They have regularly appeared in cyber-espionage campaigns, but they are not exclusively involved in these types of attacks.
Nikkei, a Japanese news agency, reports that the attackers stole user data, such as customer names, home addresses, email addresses, passport numbers.
Of these, more than 4,300 numbers were for valid passwords, a JTB spokesperson confirmed to Nikkei.
“We apologize for the problems and concern we caused to our customers and other people”
Hiroyuki Takahashi, President of JTB, said at a press conference two weeks ago.
Japanese media have not reported whether the stolen data was used in any transactions, but fraudsters tend to accumulate data before using it, which is usually after a few years.
