Access control flaw in BOOKOFF member system exploited, exposing addresses, phones and password hashes of about 6.38 million people

BOOKOFF Group announced on October 9 that a third party accessed its subsidiary's member management system without authorization, leaking up to about 6.43 million member records ^[2]. Its third report on November 6 says the attacker abused an access control problem in part of the system handling member data to take data between October 4 and 6, affecting 6,383,279 people, including names, birth dates, emails, phones, addresses and password hashes, but not payment data ^[1][2]. Members should change their BOOKOFF online store and app passwords and any reused passwords, doing so directly in the official app or site rather than via email links ^[1].

Industries mainly affected: Retail

1. Change your BOOKOFF online store and app passwords ^[1].
2. Change identical or similar passwords used on other services ^[1].