--- title: "COMSBI SaaS account and data compromise" description: "Sonicmoov confirmed theft through COMSBI SaaS operations accounts, with customer and LINE profile information affected." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-14" canonical_url: "https://www.ally.security/incidents/comsbi-saas-account-and-data-compromise-2026" markdown_url: "https://www.ally.security/incidents/comsbi-saas-account-and-data-compromise-2026.md" stix_url: "https://www.ally.security/incidents/comsbi-saas-account-and-data-compromise-2026/stix.json" --- # COMSBI SaaS account and data compromise Sonicmoov confirmed theft through COMSBI SaaS operations accounts, with customer and LINE profile information affected. Last modified Nov 14, 2026 · 3 sources ## Summary - **Environment:** COMSBI SaaS administration and cloud environment - **Operational impact:** Provider blocked access; SaaS service remained available - **Financial impact:** No confirmed incident cost quantified ## What happened [Sonicmoov](https://sonicmoov.com/) confirmed an intruder used operations/support accounts to take multiple customers’ data from [COMSBI](https://www.comsbi.com/) SaaS during November 9–10, 2026. Cloud configuration and credentials were also accessed. [3](#source-3) ## Impact - Exposed fields varied by customer, including identity/contact information and LINE profiles. Sonicmoov excluded its separate Enterprise platform and said SaaS held no card data. [3](#source-3) - [Human Adjust](https://human-adjust.co.jp/) reported preliminary maxima of 58,510 user records and 116,518 LINE-friend profiles; these potentially overlapping groups are not a combined person count. [1](#source-1) - [Tokyo Tatemono](https://tatemono.com/) confirmed leakage affecting up to 490 users of its Nihonbashi-building LINE service, including contacts, registration answers and profiles. It excluded card details, passwords, addresses and birth dates. [2](#source-2) ## Timeline ### November 9, 2026 — Unauthorized access begins Operations/support accounts were misused. [3](#source-3) ### November 10, 2026 — Access blocked and accounts reset Detection at 07:36 JST preceded containment actions completed by 09:17. [3](#source-3) ### November 12, 2026 — Provider discloses breach The [provider notice](https://sonicmoov.com/news/5ttj9ndzh) describes scope and response. [3](#source-3) ### November 14, 2026 — Briefing updated This briefing was last reviewed and updated on November 14, 2026. ## Threat Group & Attack Vector Compromised internal credentials provided cross-customer administrative access. How the credentials were obtained remained under investigation. [3](#source-3) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): operations/support credentials enabled administrative access. [3](#source-3) ## Response Sonicmoov blocked abusive access, reset accounts and began rotating credentials and strengthening authentication. Service remained available. [3](#source-3) Downstream scope appears in the [Human Adjust notice](https://human-adjust.co.jp/system/wp-content/uploads/2026/11/2bc5fe7b03948188b21ef5e120684a70.pdf) and [Tokyo Tatemono notice](https://tatemono.com/news/images/8e3fa062877536ef406dc45520e09dc9.pdf). ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Human Adjust COMSBI SaaS exposure notice official · Human Adjust · Nov 13, 2026 ### Tokyo Tatemono COMSBI customer notice official · Tokyo Tatemono · Nov 13, 2026 ### COMSBI SaaS unauthorized-access notice official · Sonicmoov · Nov 12, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** COMSBI SaaS account and data compromise: Provider discloses breach 2. **Disclosed At · 100% confidence · current** COMSBI SaaS account and data compromise: 2026-11-12 3. **Discovered At · 100% confidence · current** COMSBI SaaS account and data compromise: 2026-11-10 4. **Ended At · 100% confidence · current** COMSBI SaaS account and data compromise: 2026-11-10 5. **Resulted In · 100% confidence · current** COMSBI SaaS account and data compromise: Unauthorized access begins 6. **Resulted In · 100% confidence · current** COMSBI SaaS account and data compromise: Tokyo Tatemono confirmed leakage affecting up to 490 registered users of its Nihonbashi-building LINE service. Fields included contacts, registration answers and LINE profiles; card details, passwords, addresses and birth dates were excluded. 7. **Resulted In · 100% confidence · current** COMSBI SaaS account and data compromise: An intruder used Sonicmoov operations/support accounts to extract multiple customers’ data from COMSBI SaaS, and accessed cloud configuration and credentials, during November 9–10, 2026. How the credentials were obtained remained under investigation. 8. **Began At · 100% confidence · current** COMSBI SaaS account and data compromise: 2026-11-09 9. **Resulted In · 100% confidence · current** COMSBI SaaS account and data compromise: Human Adjust reported potential exposure of at most 58,510 user records and 116,518 LINE-friend profiles. These preliminary groups may overlap and must not be added into a unique-person total. 10. **Used Attack Technique · 100% confidence · current** COMSBI SaaS account and data compromise: https://attack.mitre.org/techniques/T1078/ 11. **Affected Organization · 100% confidence · current** COMSBI SaaS account and data compromise: Sonicmoov Co., Ltd. 12. **Vendor Of · 100% confidence · current** Sonicmoov Co., Ltd.: Tokyo Tatemono Co., Ltd. 13. **Occurred At · 100% confidence · current** Unauthorized access begins: 2026-11-09 14. **Resulted In · 100% confidence · current** COMSBI SaaS account and data compromise: Exposed fields varied by customer and included identity/contact details and LINE profile information. Sonicmoov said the separate COMSBI Enterprise platform was unaffected and SaaS held no payment-card information. 15. **Affected Organization · 100% confidence · current** COMSBI SaaS account and data compromise: Tokyo Tatemono Co., Ltd. 16. **Affected Organization · 100% confidence · current** COMSBI SaaS account and data compromise: Human Adjust Co., Ltd. 17. **Occurred At · 100% confidence · current** Provider discloses breach: 2026-11-12 18. **Vendor Of · 100% confidence · current** Sonicmoov Co., Ltd.: Human Adjust Co., Ltd. 19. **Resulted In · 100% confidence · current** COMSBI SaaS account and data compromise: Access blocked and accounts reset 20. **Occurred At · 100% confidence · current** Access blocked and accounts reset: 2026-11-10 21. **Resulted In · 100% confidence · current** COMSBI SaaS account and data compromise: Sonicmoov detected cloud anomalies at 07:36 JST November 10, blocked abusive permissions and completed source blocking/password changes/forced logout by 09:17. Credential rotation and stronger authentication were underway; service remained available.