Summary

Multiple HKISG members reported elevated failed-login velocity against customer-facing SaaS portals hosted for Hong Kong tenants. Patterns are consistent with credential-stuffing: dispersed source IPs, reused passwords from prior breaches, and bursts against common usernames.

This bulletin is an early-warning note for operators. It is not an HKCERT directive.

Who is affected

  • SaaS providers with password-based customer login in Hong Kong or serving HK customers
  • Enterprises exposing VPN, email, or partner portals without phishing-resistant MFA
  • Shared accounts and service accounts that still accept passwords alone

Observed indicators

  • Spike in HTTP 401/403 on /login and token endpoints
  • Many distinct source ASNs within short windows
  • Low success rate overall, but occasional privilege hits where password reuse exists
  • Follow-on password-reset abuse after a small number of successful logins

Immediate mitigations (24–72 hours)

  1. Enable or tighten rate-limits and progressive lockouts on authentication endpoints
  2. Require MFA — prefer passkeys / FIDO2 for privileged and admin roles
  3. Block known stuffing tool fingerprints where WAF rules are reliable
  4. Force password reset for accounts showing stuffing success
  5. Alert on impossible-travel and impossible-velocity session creation
  6. Review break-glass accounts and disable unused local admins

Detection queries to ask your vendor or SOC

  • Top usernames by failed login in the last 7 days
  • Success rate by ASN and user-agent cluster
  • New MFA enrolments after successful stuffing logins (attacker persistence)

Business and customer communication

If customer accounts were accessed, prepare a factual notice with timestamps, affected product scope, and remediation steps. Avoid speculative blame. Align legal and PR before mass email.

How this maps to HKISG programmes

Status

Open monitoring. HKISG will update this bulletin if campaign volume or targeting changes materially.