--- title: "TONARIWA management-account compromise" description: "Dentsu Digital confirmed a TONARIWA management-account compromise and personal-data leakage affecting two client companies." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-12" canonical_url: "https://www.ally.security/incidents/tonariwa-management-account-compromise-2026" markdown_url: "https://www.ally.security/incidents/tonariwa-management-account-compromise-2026.md" stix_url: "https://www.ally.security/incidents/tonariwa-management-account-compromise-2026/stix.json" --- # TONARIWA management-account compromise Dentsu Digital confirmed a TONARIWA management-account compromise and personal-data leakage affecting two client companies. Last modified Nov 12, 2026 · 2 sources ## Summary - **Environment:** TONARIWA marketing platform and LINE integration credentials - **Operational impact:** All servers isolated; service restart undecided - **Financial impact:** No confirmed incident cost quantified ## What happened [Dentsu Digital](https://www.dentsudigital.co.jp/) detected unauthorized access and privilege escalation through leaked TONARIWA management-account credentials on November 10, 2026, then suspended the platform. [2](#source-2) Its [second report](https://www.dentsudigital.co.jp/news/updates/services/2026-1112-001112) confirmed data removal affecting two client companies. [1](#source-1) ## Impact Affected categories included end-user names, birth dates and contact details, plus management-account information such as LINE integration access tokens. Payment-card and bank-account data were excluded. Other clients and record counts remained under investigation; misuse had not been confirmed. [1](#source-1) ## Timeline ### November 10, 2026 — Compromise detected; service suspended The management account was accessed and its privileges escalated. [2](#source-2) ### November 11, 2026 — Possible leakage disclosed The [first report](https://www.dentsudigital.co.jp/news/updates/services/2026-1111-001111) described potential exposure. [2](#source-2) ### November 12, 2026 — Leakage confirmed Logs established external data removal involving two client companies. [1](#source-1) ### November 12, 2026 — Briefing updated This briefing was last reviewed and updated on November 12, 2026. ## Threat Group & Attack Vector Leaked management credentials enabled access. How those credentials leaked and the precise escalation method remain unresolved. [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): leaked management credentials enabled unauthorized access. [2](#source-2) ## Response Dentsu Digital revoked credentials, blocked access routes and isolated all servers. It was coordinating client notifications, regulatory reporting and LINE token replacement. Restart was undecided; investigation and safety verification could take months, with alternative environments or migration under consideration. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### TONARIWA personal-data leakage second report official · Dentsu Digital · Nov 12, 2026 ### TONARIWA unauthorized-access first report official · Dentsu Digital · Nov 11, 2026
Evidence ledger Review the supporting structured claims. 1. **Discovered At · 100% confidence · current** TONARIWA management-account compromise: 2026-11-10 2. **Resulted In · 100% confidence · current** TONARIWA management-account compromise: Dentsu Digital invalidated compromised credentials, blocked access routes and isolated all servers. It was coordinating client notices, privacy-regulator reports and LINE token invalidation/reissue. 3. **Resulted In · 100% confidence · current** TONARIWA management-account compromise: Leakage confirmed for two client companies 4. **Resulted In · 100% confidence · current** TONARIWA management-account compromise: On November 10 Dentsu Digital confirmed unauthorized access and privilege escalation using leaked credentials for a TONARIWA infrastructure management account, and suspended the platform. 5. **Occurred At · 100% confidence · current** Initial possible-exposure notice issued: 2026-11-11 6. **Resulted In · 100% confidence · current** TONARIWA management-account compromise: Management-account compromise detected; service suspended 7. **Disclosed At · 100% confidence · current** TONARIWA management-account compromise: 2026-11-11 8. **Used Attack Technique · 100% confidence · current** TONARIWA management-account compromise: https://attack.mitre.org/techniques/T1078/ 9. **Occurred At · 100% confidence · current** Leakage confirmed for two client companies: 2026-11-12 10. **Occurred At · 100% confidence · current** Management-account compromise detected; service suspended: 2026-11-10 11. **Resulted In · 100% confidence · current** TONARIWA management-account compromise: Initial possible-exposure notice issued 12. **Resulted In · 100% confidence · current** TONARIWA management-account compromise: Service restart remained undecided. Detailed investigation, prevention measures and independent safety checks could take months, while alternative environments or successor-system migration were being considered. 13. **Resulted In · 100% confidence · current** TONARIWA management-account compromise: Affected categories included end-user names, birth dates and contact information, plus TONARIWA management-account information such as LINE integration access tokens. Payment-card and bank-account data were excluded; misuse had not been confirmed. 14. **Affected Organization · 100% confidence · current** TONARIWA management-account compromise: Dentsu Digital 15. **Resulted In · 100% confidence · current** TONARIWA management-account compromise: The November 12 investigation found logs showing external data removal and confirmed personal-information leakage involving two client companies. Other clients and affected-record counts were still being assessed.