[Investigating][Severity: Major][Credential abuse]

Dentsu Digital: intrusion into TONARIWA may expose client companies’ customer data

Leaked admin credentials let an intruder into TONARIWA. Some client companies’ customer names, birth dates and contact details may have leaked; the service is stopped.

Disclosed

2026-11-11

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

What happened

Credentials for an admin account on the system platform of TONARIWA, a service for running LINE official accounts, leaked, and on 10 November an intruder got in and escalated privileges. Dentsu Digital stopped the service that day, revoked the credentials and isolated all servers. It is investigating with outside specialists. [1]

Impact and response

The data at risk includes end users’ names, birth dates, contact details and other personal data held for some client companies, plus TONARIWA admin account data such as LINE official account access tokens. Payment data is not included. The affected clients, counts and fields are still being identified, and no misuse has been seen so far. [1]

Because access tokens could be misused to send suspicious messages from client companies’ LINE official accounts, it warned users to be careful. Reports to the Personal Information Protection Commission are being coordinated with the client companies. [1]