Hamburger Hochbahn confirms credential stuffing attack on hvv switch app

Hamburger Hochbahn has confirmed that the hvv switch app was targeted by a credential stuffing attack. This method involves third parties attempting to access accounts using email and password combinations obtained from data leaks of other online services.

The company stated that there is currently no evidence that the hvv switch app, Hochbahn systems, or hvv systems themselves were compromised, nor was a technical vulnerability in the app exploited. Instead, attackers used valid credentials belonging to individual customers that were likely sourced from external leaks.

To protect users, the company initially secured identified affected accounts. Following a subsequent increase in unauthorized login attempts, Hochbahn proactively reset the passwords of all 2.5 million hvv switch customers. Customers were notified via email and push notifications and can reset their passwords using the ‘forgot password’ function. The company is also working on developing new login and identity management security features.