According to Japanese newspaper The Yomiuri Shimbun, Tokyo’s Metropolitan Police Department cracked down on Tokyo-based Nicchu Shinsei Corp. in November where they found a server that had stolen usernames and passwords belonging to 18 million Internet users.

Of the 18 million credentials, roughly 1.78 million are said to belong to customers of Yahoo Japan (90 percent), e-commerce company Rakuten, Twitter, Facebook, and other websites. Yahoo Japan said it reset the passwords of affected users.

The servers were used by hackers to leverage the credentials to send messages to users in an effort to lure them to fraud websites, and steal reward points earned by victims on online services. They were also used by hackers to find valid credentials by automatically trying to log in to accounts. Police said the company’s servers had also been used to conduct illegal money transfers.

The firm’s president and several other employees were arrested and indicted.

This was not the first time authorities had found personal info on a server. Last year, police reported finding nearly 8 million stolen credentials on a server that had been used as a proxy.

Source: Security" onclick="window.open(this.href);return false;">http://www.securityweek.com/18-million-stolen-credentials-found-japan" onclick="window.open(this.href);return false;">Security Week[3