Japan Post 'Yu-ID' Unauthorized Logins Possibly Caused by List Attack Using Passwords Leaked Elsewhere; Two-Factor Authentication Now Mandatory

What happened

On October 19, Japan Post said that personal data from 249 Yu ID accounts may have leaked. Attackers used a list of IDs and passwords that had leaked from other companies. They pretended to be Yu ID members and logged in to the Yu Yu Point website. Japan Post stopped the Yu Yu Point site on October 16. From October 20, logging in to Yu ID requires two-step verification.

Key facts

• 249 accounts were affected.
• Data that may have been seen: name, address, date of birth, gender, phone number, and email address.
• For one account, 83 saved address records may have been taken.
• The suspicious access was found on October 15.
• Japan Post has not confirmed a leak from its own systems.

Background

Many people use the same ID and password on several websites. If one site leaks them, attackers can try the same pair on other sites. This type of attack is called a list attack. Two-step verification asks for a second proof, such as a code sent to your phone, in addition to your password.

Why it matters

This shows that reusing passwords is risky, even for big services. Users should change their passwords, set up a passkey (a login method that does not need a typed password), and turn on two-step verification. Japan Post will contact affected users by phone and ask them to reset their passwords.

What to watch

• Whether Japan Post finds more affected accounts.
• When the Yu Yu Point site opens again.
• How many users switch to passkeys or two-step verification.
• Whether the attack is linked to the earlier Post Office app breach announced on September 29.