KOMOJU: unauthorized access to payment and CRM systems

KOMOJU disclosed on October 22 that attackers exploited a vulnerability in its non-production environment from the evening of October 13 and logged into internal management systems. It detected suspicious access early October 14 and blocked the route that morning. About 4,100 personal-data records including emails and some merchants' API credentials leaked. Its CRM was also accessed, with scope under investigation. The separate card-storage system was not accessed and no card leakage or unauthorized payments were confirmed. Credential rotation temporarily disrupted some Shopify payment methods October 16 and Seven-Eleven payment barcode display October 18. Its second report on 26 October said the attacker used an API key to reach the CRM through its API. Inquiry records of merchant and partner staff and of consumers who asked about payments leaked, including inquiry history, email addresses, names, phone numbers, addresses, birth dates, bank account details for refunds and identity documents from merchant screening. No card data is included. No count was given; these are separate from the roughly 4,100 records in the payment system.