Stolen Sonicmoov support credentials expose customer data in COMSBI SaaS
Sonicmoov says an attacker used internal support accounts with access to multiple customers of COMSBI SaaS, a LINE integration service. The attacker obtained customer data and also accessed the cloud environment, taking configuration data and credentials. The vendor is rotating integration credentials.
- Disclosed
- Nov 12, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Organizations using the affected COMSBI SaaS tenants, their end users and followers of connected LINE Official Accounts.
- SaaS · LINE · Data breach
- In the wild
- Yes
What happened
The compromised Sonicmoov accounts could administer multiple customers. How the attacker obtained the credentials remains under investigation. Sonicmoov says affected fields varied by customer and included names, phone numbers, email addresses, postal addresses, birth dates and gender. LINE follower data included display names, profile images, status messages and system-assigned LINE user IDs, which differ from the LINE IDs people choose for friend search. The SaaS does not store credit card data.
Tokyo Tatemono’s notice applies to registered members of its Nihonbashi building workers account. It excludes passwords, home addresses, dates of birth and card data for that account. Human Adjust’s two figures are preliminary upper bounds. Overlap is unknown and Sonicmoov has published no aggregate affected count.
Sonicmoov says this compromise affected the SaaS environment. Its separately hosted Enterprise Infrastructure had its own earlier incident and credential response; Sonicmoov explicitly excludes it from this SaaS incident. For the SaaS, Sonicmoov says it restricted bulk data access and plans mandatory two-step authentication and source restrictions for the admin interface. Its notice does not confirm completion of every LINE credential rotation.
Keihan Holdings published upper bounds by account. Potential exposure at Keihan Railway’s fan account covers 26,914 follower profiles. Kyoto Tower Sando lists 90,550 follower profiles and nine people’s names or addresses. Hirakata Mall lists 46,957 follower profiles and 35,025 people’s birth dates or gender. Keihan Department Store lists 51,223 follower profiles and 28,000 people’s other personal details. THE THOUSAND KYOTO and Kyoto Century Hotel together list 8,742 follower profiles and 1,298 people’s other personal details. Keihan says the counts can overlap both across accounts and between data categories within an account.
Crime-scene timeline
Nov 9–10, 2026
Internal accounts are used to obtain tenant data
Sonicmoov says it detected abnormal cloud activity on November 10, blocked the abused permissions and attack traffic, reset internal passwords and forced logouts.
Nov 12, 2026
Sonicmoov discloses the SaaS compromise
The company confirms exfiltration and says LINE integration credential rotation is in progress. The SaaS remains available.
Nov 13, 2026
Tokyo Tatemono and Human Adjust disclose their scope
Tokyo Tatemono confirms exposure involving up to 490 people. Human Adjust reports two potential exposure categories, up to 58,510 service users and up to 116,518 LINE followers.
Nov 14, 2026
Keihan Holdings reports scope across four subsidiaries
The group lists potentially affected LINE followers and other customer data by account and warns that counts can overlap.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Sonicmoov SaaS incident noticePrimaryConfirms the entry path, affected data categories, containment and ongoing credential rotation.
- Tokyo Tatemono customer noticePrimaryConfirms exposure and gives the current upper bound for its Nihonbashi building workers LINE account.
- Human Adjust disclosurePrimaryLists separate upper bounds for service users and followers.
- Sonicmoov Enterprise Infrastructure follow-upPrimaryDescribes a separate event and its credential response.
- Keihan Holdings November 14 customer noticePrimaryLists affected LINE accounts, upper bounds by data category and possible double counting.