We prioritized accurately identifying the scope of impact and the facts. Immediately after becoming aware of the incident, we took containment measures such as blocking unauthorized communications.
Timeline from the incident to the announcements
- From the evening of October 13, 2026: An external third party accessed our non-production environment without authorization
- Early morning of October 14, 2026: We detected an increase in suspicious access and started an investigation
- The same morning: We took initial measures, such as blocking the unauthorized access route, disabling related accounts and login sessions, and fixing the security vulnerabilities
- October 22, 2026: We published our first report (impact on the KOMOJU payment system, and confirmation of unauthorized access to the CRM system)
- October 26, 2026: We published our second report (leak of personal data from the CRM system)
What did you do before the announcement?
After containment, with the cooperation of external specialists, we comprehensively analyzed access logs and other records, prioritizing accurate identification of the scope of impact and the objective facts. This was to avoid causing further confusion for merchants and customers by releasing uncertain information. As a result, it took some time before the announcement.
Wasn't the announcement too late?
To share the accurate scope of impact, we prioritized identifying the facts through our investigation. Our investigation is ongoing, and we will promptly announce any new findings on our official website.
Were merchant accounts also disabled?
The accounts we disabled were KOMOJU employee accounts. We have not suspended or disabled merchants' KOMOJU accounts in response to this incident.