TONARIWA compromise exposes personal information held for two client companies
Dentsu Digital found unauthorized access and privilege escalation using leaked TONARIWA infrastructure management credentials. It shut down the platform and confirmed personal data exfiltration involving two clients. The number of affected people is under investigation.
- Disclosed
- Nov 11, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- TONARIWA clients, their end users and LINE Official Account integrations connected to the platform
- data breach · SaaS · LINE
- In the wild
- Not applicable
What happened
Dentsu Digital says stolen management credentials were used to access TONARIWA infrastructure and gain greater privileges. It revoked the credentials used, blocked the access path and isolated the environment by stopping all servers. It is coordinating revocation or reissue of the separate LINE integration credentials.
On November 12 the provider said its logs showed data extraction involving two client companies. It listed names, dates of birth, contact information and administrative account information such as LINE access tokens among the data at issue. It excluded card and bank account information and reported no known misuse at that point. Individual record counts remain unknown. The confirmed extraction, service suspension and possible integration credential exposure warrant L3 while the wider impact is being investigated.
Pasona confirmed some linked job-seeker information leaked and reported finding no signs of access to its own applicant management systems at the time. Japan Post reported possible exposure involving its Posukuma LINE survey integration. It had not verified unauthorized acquisition in its notice. Dentsu Digital is investigating restoration and preparing alternatives for customers. It is also coordinating with affected clients on notifications and reporting to Japan’s Personal Information Protection Commission.
Crime-scene timeline
Nov 10, 2026
Dentsu Digital confirms unauthorized access and privilege escalation
The intruder used leaked infrastructure management credentials.
Nov 11, 2026
Dentsu Digital discloses the intrusion and platform suspension
Japan Post separately warns of possible exposure and puts its Posukuma LINE service into emergency maintenance.
Nov 12, 2026
Dentsu Digital confirms data exfiltration for two clients
Logs show data left the platform. The provider is still determining the record count and checking other clients.
Nov 13, 2026
Pasona confirms exposure of some data shared with TONARIWA
Pasona uses the system for LINE communication with job seekers and is determining which individuals and fields were affected.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Dentsu Digital initial noticePrimaryDetails the infrastructure credential leak, privilege escalation and initial response.
- Dentsu Digital second noticePrimaryConfirms exfiltration at two clients and describes isolation, credential work and recovery planning.
- Japan Post customer noticePrimaryDescribes the affected LINE survey integration and emergency maintenance.
- Pasona customer noticePrimaryConfirms exposure of some information shared with the provider.
- LINE Developers channel access token guidePrimaryDescribes token types and links to their revocation procedures.