JP — ITmedia

Lottery Official Site Suspended After User Passwords Were "Unintentionally Changed"; Scope Under Investigation

SecurityNovember 6, 20261 min read

The official Japanese lottery website was paused after users' passwords were changed by mistake. The operator is still checking how many people were affected.

What happened

On November 5, 2026, the official X account for the lottery said it found a problem on the official lottery website. Some users' passwords had changed without their intent. The site was paused, and the team is working to find out who was affected. They say they will tell affected people once they know more. When ITmedia checked on November 6, the site still showed a page saying it was suspended, with no restart date. Users of the "continued purchase campaign" also could not sign up while the site was paused. Lottery counters at stores are still open as usual.

Key facts

Problem found and site paused: November 5, 2026
Site still paused when ITmedia checked: 10:00 a.m., November 6, 2026
No restart date has been announced
Store sales are running as normal
The cause and the number of affected accounts have not been shared

Why it matters

Passwords are the keys to user accounts. If someone else got access, they could do harm. The lottery says that people who use the same ID and password on other websites or apps should think about changing them now. This is a simple step that protects them while the cause is still unknown.

What to watch

Whether the lottery announces the cause of the password changes
How many users were affected, and how they will be told
When the official site will restart and whether the campaign sign-up reopens

Matsuya App Restored After 9 Days, With Up to 3x Points as an Apology

Matsuya Foods Holdings announced on November 6 that the Matsuya official app, suspended since October 28 after unauthorized access, has been restored and requires an update to use. Through November 30, the bento reservation service "Matsuya Bento Net" offers double Matsuya Points, and mobile orders earn triple points. The company disclosed on October 30 that about 2.38 million pieces of personal information had been leaked from the app's management system.

SecurityThe RegisterNov 6

Feds warn grocers: Don't chill on cyber defenses as freezer hacking spree heats up

US federal agencies, including the FBI and CISA, urged owners and operators of industrial smart freezers to disconnect them from the internet, apply patches, and change default passwords. The warning follows hacks of thousands of refrigeration systems at hundreds of grocery stores in Europe since mid-October, which raised temperatures to 50ºC and spoiled food. The article notes no documented attacks on American supermarkets had been confirmed at the time of publication.

SecurityThe RegisterNov 6

Threat actor targets Indian fintechs on weekends when defenders aren’t watching

India's CERT-IN has warned of a "significant escalation" in attacks by an AI-assisted threat actor it calls CRAFTY FALCON, which targets fintechs and payment providers. The group re-targets victims, including after incomplete remediation, and times attacks to holidays and weekends to delay detection. CERT-IN urges better logging, real-time monitoring, keeping test environments off the internet, and 24x7 monitoring.

SecurityArs TechnicaNov 6

Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

A decade-old vulnerability affects devices running some configurations of Alpine Linux and possibly other distributions, allowing attackers to log in without a password. It arises from the interaction between OpenSSH and musl, and requires that OpenSSH not use PAM, that an account have a SHA256 or SHA512 hashed password, and that the account be set to passwordless with "*" in /etc/shadow. Alpine maintainers warned that an attacker who can reach the SSH port can log in in a single connection, every time.