Sonicmoov: unauthorized login to the COMSBI SaaS LINE service leaks user data of its clients

Sonicmoov Co., Ltd. said on 12 November that its cloud LINE integration service COMSBI SaaS had been accessed without authorization. At 23:04 on 9 November a third party logged in to the admin screen with a staff account used for operations and support and began taking data of several client organizations, adding other staff accounts from 02:15 on 10 November. It also entered the cloud environment that runs the service and took system settings and credentials. The service runs on a different system from the COMSBI Enterprise platform breached in October, whose users are not affected. [1]

For some client organizations, user names, phone numbers, email addresses, addresses, birth dates, gender and other items (varying by client) leaked, along with the display names, profile images, status messages and LINE user IDs of their LINE official account friends. The number of records and of clients has not been given. No card data is stored. The service remains available. [1]

The credentials of staff accounts were stolen, and those accounts could operate several clients' environments. How the credentials were obtained is under investigation. Sonicmoov detected the anomaly in its cloud environment at 07:36 on 10 November and revoked the abused permissions, blocked the attacker by 09:17, changed the staff passwords and forced them to log out. It is renewing the LINE integration credentials and adding limits on bulk data access, mandatory two-factor authentication and source restrictions. [1]