1 article with this tag
Account takeovers began the day after launch; ~808 users lost ~¥38.6M. The core failure was authentication design: (1) no two-factor authentication, so login needed only ID + password, and (2) a password reset that could send the new password to an email address other than the registered one — so fragments of personal data were enough to hijack an account. Defend by requiring 2FA on sensitive actions, restricting password reset to registered channels, detecting and locking credential-stuffing, and having auth flows reviewed by a second set of eyes before launch.