Japan's official lottery website and its companion app have been taken offline after operators found that outsiders had gained access to some user accounts. Prefectures and designated cities across the country announced the temporary suspension on November 6.
The shutdown followed reports that some members' passwords had been changed without their consent and that unauthorized logins had been confirmed on certain accounts. No date has been given for bringing the services back online, according to a report by ASCII.jp.
What Prompted the Suspension
The problem came to light when users found their passwords had been altered without their knowledge. The operators then confirmed that third parties had logged into some accounts.
Because of this access, members' personal information may have been seen by outsiders. The operators chose to suspend both the website and the app while they deal with the issue.
No Sign of a Server Breach
The operators said they found no evidence that their servers or databases had been broken into. They have also not confirmed any leak of member data from their own systems.
Instead, they believe the attackers used email address and password combinations obtained from outside sources. This method, often called credential stuffing, depends on people reusing the same login details across several services.
Advice for Lottery App Users
Users who use the same email and password on multiple platforms are being urged to change their passwords. When one service is compromised, reused credentials can open the door to other accounts.
The operators also warned members not to enter their IDs or passwords on emails or websites pretending to be the official lottery service. Phishing attempts often follow well-publicized security incidents.
Other Ways to Buy Tickets Remain Open
In a follow-up announcement on November 9, the operators said that other sales channels are still working normally. These include lottery retailers across the country, sales websites run by financial institutions, and lottery purchases through ATMs.
The range of tickets on offer differs depending on where they are bought. The operators said they will share updates on the recovery through official announcements.
What This Means for App Builders and Users
The incident shows that an app can be exposed even when its own infrastructure has not been breached. Stolen credentials from elsewhere can still be used to take over accounts and change passwords.
For companies running consumer apps, it points to the value of protections such as multi-factor authentication and tools that detect suspicious login patterns. For users, the simplest defense is still a unique password for every service.
Source: ASCII.jp
