> JapanHacked_
[Contained][Severity: Major][Credential abuse]

BookLive: credential stuffing on the BookLive e-book store logged into 6,127 accounts

Email and password pairs apparently obtained elsewhere were used to log into 6,127 accounts. The My Page top and the first page of the bookshelf may have been viewed.

Disclosed

2026-11-12

Organizations involved

1

Leaked or at risk

6.1K

6,127

Downtime

Unknown

Accounts affected or at risk

6.1K

6,127

What happened

BookLive Co., Ltd. said on 12 November that a credential-stuffing attack on its e-book store BookLive, using email and password pairs apparently obtained elsewhere, logged into 6,127 accounts from about 06:00 to 12:15 on 10 November. The My Page top and the first page of My Bookshelf may have been viewed; card data was not. No intrusion into its servers or database was found. [1] [2]

It stopped new logins at 12:15 and logged the accounts out, then made two-factor authentication mandatory for email logins and reopened logins at 20:00. Affected users are told by email. [1]

Timeline

  1. Detected 2026-11-10
  2. Disclosed 2026-11-12
  3. 2 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak]
Entry point
Stolen credentials

Data exposed or at risk

[Purchase history]

Services hit

Organizations involved

Sources

  1. [1][Official]ブックライブストアにおける、外部で入手されたとみられる認証情報の悪用による、一部のお客様アカウントへの不正ログインに関するお詫びとお知らせBookLive
  2. [2][News]「ブックライブ」にリスト型攻撃 「My本棚」の1ページ目が閲覧された可能性Otakuma Keizai Shimbun