TINYpulse breach exposes Nintendo employee credentials
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
TINYpulse platform compromised affecting 1.2M users and 115 Nintendo employees; 32 third-party credentials exposed.
A breach of the TINYpulse employee engagement platform has resulted in unauthorized access to user accounts and sensitive employee data. The incident affected approximately 1.2 million users and compromised credentials for 115 Nintendo employees, along with 32 third-party employee accounts. The breach was disclosed via ransomware threat actors, indicating the compromised credentials may be leveraged for further attacks. TINYpulse is widely used by organizations for employee surveys and engagement management, making this incident significant for any organization using the platform. Defenders should assume credentials obtained from this breach will be used in credential-stuffing attacks, phishing campaigns, or as initial access vectors for targeted intrusions against affected organizations.
Mentioned in this report
Detection guidance
Entra ID Protection Leaked Credentials Risk Detection
Entra ID Protection flags a user whose valid credentials were found in a leaked-credential source, such as a third-party SaaS breach. The credentials are likely to be used for stuffing or initial access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Entra ID Protection Leaked Credentials Risk Detection
description: Detects an Entra ID Protection risk detection of type leakedCredentials,
meaning a user's valid credentials appeared in a breach dump (for example a third-party
SaaS breach such as an employee engagement platform). Treat as a trigger for forced
password reset and review of recent sign-ins.
tags:
- attack.reconnaissance
- attack.t1589.001
- attack.initial-access
- attack.t1586.003
logsource:
product: azure
service: riskdetection
detection:
selection:
riskEventType: leakedCredentials
condition: selection
falsepositives:
- Users who reused a personal password that appeared in a public dump and have already
reset it
- Test accounts seeded with known leaked passwords for security awareness exercises
level: medium
id: ca74fa2c-0dfe-5834-8df4-d8df03747e95
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VElOWXB1bHNlIE5JTlRFTkRPIEJSRUFDSCAobmludGVuZG8uY29tKUBTaGFkb3dCeXQzJA==
Entra ID Sign-in Blocked By Smart Lockout Indicating Credential Stuffing
Azure AD sign-in events with result code 50053 (account locked after repeated bad passwords). A cluster of these across many accounts suggests credential stuffing with breached credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Entra ID Sign-in Blocked By Smart Lockout Indicating Credential Stuffing
description: Detects Entra ID sign-in failures with ResultType 50053 (IdsLocked, account
locked by smart lockout after repeated invalid password attempts). Individual events
are common; alert volume or the number of distinct users over a short window should
be assessed in the SIEM to identify credential stuffing with breached credentials.
tags:
- attack.credential-access
- attack.t1110.004
- attack.t1586.003
logsource:
product: azure
service: signinlogs
detection:
selection:
ResultType: '50053'
condition: selection
falsepositives:
- Users repeatedly mistyping passwords or using stale cached credentials on mobile
devices
- Misconfigured service accounts or legacy applications retrying with an old password
level: medium
id: 72fb6324-2239-5c67-9c15-506df90db340
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VElOWXB1bHNlIE5JTlRFTkRPIEJSRUFDSCAobmludGVuZG8uY29tKUBTaGFkb3dCeXQzJA==
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/VElOWXB1bHNlIE5JTlRFTkRPIEJSRUFDSCAobmludGVuZG8uY29tKUBTaGFkb3dCeXQzJA==
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs