Summary
- Environment: TONARIWA marketing platform and LINE integration credentials
- Operational impact: All servers isolated; service restart undecided
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 12, 2026; updated as evidence emerges.
What happened
Dentsu Digital detected unauthorized access and privilege escalation through leaked TONARIWA management-account credentials on November 10, 2026, then suspended the platform. [2] Its second report confirmed data removal affecting two client companies. [1]
Impact
Affected categories included end-user names, birth dates and contact details, plus management-account information such as LINE integration access tokens. Payment-card and bank-account data were excluded. Other clients and record counts remained under investigation; misuse had not been confirmed. [1]
Timeline
Compromise detected; service suspended
The management account was accessed and its privileges escalated.
[2]Possible leakage disclosed
The first report described potential exposure.
[2]Leakage confirmed
Logs established external data removal involving two client companies.
[1]Briefing updated
This briefing was last reviewed and updated on November 12, 2026.
Threat Group & Attack Vector
Leaked management credentials enabled access. How those credentials leaked and the precise escalation method remain unresolved. [2]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1078 — Valid Accounts: leaked management credentials enabled unauthorized access. [2]
Response
Dentsu Digital revoked credentials, blocked access routes and isolated all servers. It was coordinating client notifications, regulatory reporting and LINE token replacement. Restart was undecided; investigation and safety verification could take months, with alternative environments or migration under consideration. [1]