Incident BriefingsCOMSBI SaaS account and data compromise

COMSBI SaaS account and data compromise

Sonicmoov confirmed theft through COMSBI SaaS operations accounts, with customer and LINE profile information affected.

Last modified

Summary

  • Environment: COMSBI SaaS administration and cloud environment
  • Operational impact: Provider blocked access; SaaS service remained available
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed November 14, 2026; updated as evidence emerges.

What happened

Sonicmoov confirmed an intruder used operations/support accounts to take multiple customers’ data from COMSBI SaaS during November 9–10, 2026. Cloud configuration and credentials were also accessed. [3]

Impact

  • Exposed fields varied by customer, including identity/contact information and LINE profiles. Sonicmoov excluded its separate Enterprise platform and said SaaS held no card data. [3]
  • Human Adjust reported preliminary maxima of 58,510 user records and 116,518 LINE-friend profiles; these potentially overlapping groups are not a combined person count. [1]
  • Tokyo Tatemono confirmed leakage affecting up to 490 users of its Nihonbashi-building LINE service, including contacts, registration answers and profiles. It excluded card details, passwords, addresses and birth dates. [2]

Timeline

  1. Unauthorized access begins

    Operations/support accounts were misused.

    [3]

  2. Access blocked and accounts reset

    Detection at 07:36 JST preceded containment actions completed by 09:17.

    [3]

  3. Provider discloses breach

    The provider notice describes scope and response.

    [3]

  4. Briefing updated

    This briefing was last reviewed and updated on November 14, 2026.

Threat Group & Attack Vector

Compromised internal credentials provided cross-customer administrative access. How the credentials were obtained remained under investigation. [3]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

Response

Sonicmoov blocked abusive access, reset accounts and began rotating credentials and strengthening authentication. Service remained available. [3] Downstream scope appears in the Human Adjust notice and Tokyo Tatemono notice.