Security Guides
Comic Cmoa Member Data Breach (Up to About 4.2 Million Records in Log Files): Email Addresses and Dates of Birth Leaked — What Users Should Do
NTT Solmare said on October 21, 2026 that unauthorized access to its e-book store Comic Cmoa leaked 319 member database records and up to about 4.2 million log-file records (email, nickname, date of birth, gender). What changed across its notices and what to do.
For: anyone registered with the e-book store Comic Cmoa (コミックシーモア, cmoa.jp), anyone who uses the same email address and password on other services, and anyone who runs a service that handles user data. This article is based on the official notices from NTT Solmare Corporation, the Japanese company that runs Comic Cmoa, and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of 11:00 JST, October 23, 2026Not yet known
- How many people the 319 database records and the 4.2 million log-file records represent
- Counts for each item in the log-file records
- What the intrusion route and attack method were (identified, but not disclosed)
- When the unauthorized access began
- The date and time the service will resume
- Whether the Personal Information Protection Commission or the police have been notified (not mentioned)
- What the apology for the suspension will be
The company says it is coordinating the resumption date with the relevant bodies and will announce it once fixed. It will give details of the password reset and the apology measures when the service resumes.
At 11:00 JST on October 23 we checked that the company's news release list has nothing newer than the fourth report (October 21). The Comic Cmoa site is suspended and directs users to NTT Solmare's news releases for the latest status.
What members should do today
Change the password of other services where you use the same one
The company warns that a third party may use the leaked email address and password combinations to try to sign in to other web services. It asks anyone who uses the same combination on other services to change the password there too.
A hashed password cannot be read as it is. In general, though, short or simple passwords can sometimes be worked out over time. When you change them, use a different long password for each service; a password manager makes this manageable.
Turn on two-step verification for important services
With a leaked email address, someone may try to sign in with it to services whose password you have not yet changed. Two-step verification (a check through a phone app or similar on top of the password) makes it harder to sign in even if the password is known. This is general advice from this site, not the company's guidance.
Start with email, banking and shopping services. How to choose a method is covered in Which 2FA method is safest?
Do not open links or attachments in emails claiming to be the company
The company warns that suspicious contacts may arrive posing as the company and leading to fake websites (phishing sites). It asks people not to open URLs or attachments in unexpected emails, and not to enter personal data or passwords on suspicious sites.
Affected people are due to be contacted by the company by email. Even with a subject such as "password reset", "service resumption" or "apology points" (our examples), do not sign in through a link in the email; check the content on NTT Solmare's news release page, opened yourself. The basics of spotting fakes are in What is phishing?
Reset your password on resumption through the app or a bookmark
The company plans to ask all users to reset their passwords when the service resumes, with details to follow at that time.
When the reset notice arrives, open the service through the official app you normally use or a bookmark, not a link in an email. Do not reuse a password from another service as the new one.
Check your subscription and payment statements
According to the company, for the unlimited-reading service and monthly plans, fees are basically not charged automatically for the period the service could not be used. Some payment methods may still be charged, and those users will be handled individually.
If you see a charge you do not recognise, contact the card company or mobile carrier you paid through. The company says credit card data did not leak.
The contact listed in the notices is the Comic Cmoa Support Center (info@nttsolmare.com, Japanese). If you have paid money or entered a card number in response to a suspicious email, contact your card company and the police consultation line (#9110 in Japan).
What happened (according to NTT Solmare)
NTT Solmare Corporation has published four notices in its news releases, from the first notice on October 15 to the fourth report on October 21. Everything below is based on those notices.
Thursday, October 15, 2026
First notice, "Emergency maintenance of Comic Cmoa". The company judged that unauthorized access from outside to the Comic Cmoa servers had very likely taken place and suspended the service to investigate. According to the second report, the service was stopped at 11:35 and the unauthorized access was blocked at the same time.Friday, October 16
Second report. The company said it had confirmed unauthorized access to the system that manages member information and the leak of member data held in it to a third party. Items: email address, hashed password, date of birth, gender, nickname. Count under examination. It asked users to change passwords on other services.Sunday, October 18
Third report. The company said it had identified the intrusion route and attack method and was dealing with them. It had found that some system log files had also been viewed and taken, and was examining whether they contained member data.Wednesday, October 21
Fourth report. The company said identifying and blocking the intrusion route and attack method was complete. It described the data confirmed as leaked as 319 member database records and up to about 4.2 million records in system log files, and said it would email the people affected.
The notices do not say when the unauthorized access began. October 15 is the day the company judged that unauthorized access had very likely taken place and stopped the service.
How the notices changed
The counts and items changed with each notice as follows.
| Notice | Status of the leak | Count | Items | Passwords |
|---|---|---|---|---|
| First notice (Oct 15) | Unauthorized access judged very likely | Not mentioned | Not mentioned | Not mentioned |
| Second report (Oct 16) | Leak of member data confirmed | Under examination | Email address, hashed password, date of birth, gender, nickname | Hashed passwords included |
| Third report (Oct 18) | In addition, some system log files found to have been viewed and taken | Still under examination | Same as the second report (logs under examination) | Hashed passwords included |
| Fourth report (Oct 21) | Leak confirmed in (1) the member database and (2) system log files | (1) 319 (2) up to about 4.2 million | (1) The five items of the second report (2) email address, nickname, date of birth, gender | (1) Hashed passwords included (2) Not included |
The statement that credit card data did not leak has stayed the same from the second to the fourth report. The second to fourth reports also all say that no leak of purchase histories and no leak, loss or damage of MY Bookshelf has been confirmed.
- Operator
- NTT Solmare Corporation
- Service
- E-book store Comic Cmoa (コミックシーモア)
- Count
- 319 records of member database registration data; up to about 4.2 million records in system log files (may include duplicates for the same person)
- Items
- The 319 records: email address, hashed password, nickname, date of birth, gender. The 4.2 million records: email address, nickname, date of birth, gender, with different items for different people
- Not leaked
- Credit card data (not held in the affected systems)
- Not confirmed
- Leak of purchase histories; leak, loss or damage of MY Bookshelf
- Cause
- Unauthorized access by a third party. Identifying and blocking the intrusion route and attack method is complete, but they have not been disclosed
- Investigation
- With an outside specialist organisation
- Contacting affected people
- By email, promptly
- Reports to authorities
- Not mentioned (the company says it is coordinating the resumption with "the relevant bodies")
- Service
- Suspended. To resume in stages, starting with web reading of purchased titles and reading in the unlimited-reading service
- Contact
- Comic Cmoa Support Center (info@nttsolmare.com)
What is known and what is not
Status as of October 23, 2026. When a follow-up is published, the status column will be updated.
| Item | What the notices say | Status |
|---|---|---|
| Judgment of unauthorized access and service suspension | Judged very likely on October 15; service stopped at 11:35 | Confirmed (company) |
| Member database registration data | 319 records: email address, hashed password, nickname, date of birth, gender | Leak confirmed (company) |
| Data in system log files | Up to about 4.2 million records: email address, nickname, date of birth, gender (items differ per person) | Leak confirmed (company) |
| How many people the records represent | The 4.2 million may include duplicates for the same person | Not mentioned |
| Passwords in the log files | Not included | Not included (company) |
| Credit card data | Not held in the affected systems; did not leak | Not included (company) |
| Purchase histories, MY Bookshelf | No leak, loss or damage confirmed | Not confirmed (company) |
| Cause | Unauthorized access by a third party | Confirmed (company) |
| Intrusion route and attack method | Identified and blocked; not described | Not mentioned |
| When the access began | Not stated | Not mentioned |
| Misuse of the leaked data | Warns that suspicious emails may arrive; does not say misuse has occurred | Not mentioned |
| Contacting affected people | By email, promptly | Planned (company) |
| Reports to the Personal Information Protection Commission, police | Not stated | Not mentioned |
| Service resumption | Being coordinated with the relevant bodies; to resume in stages | Not yet fixed (being coordinated) |
| Password reset on resumption | All users to be asked; details on resumption | Planned (company) |
| Subscriptions, points, apology | Monthly fees basically not charged during the suspension; re-granting points and an apology under consideration | Under consideration (company) |
Reading note: do not add the two counts together
The 319 records and the up to about 4.2 million records are separate figures from different places (the member database and system log files) with different items. The notices do not say whether the same people appear in both, so this site does not add them together.
The 4.2 million figure is also a count of records, not people. The company says it may include duplicates for the same person.
What the leaked combinations of items can lead to
The following is what can happen in general; it does not mean it has already happened in this case.
Email address + hashed password (319 records)
↓→
Attempts to sign in to other services as you
→ Change the password where it is reused / two-step verification
Email address + nickname
↓→
Fake emails posing as the company that address you by your nickname
→ A correct nickname is not proof / do not open links
Email address + date of birth
↓→
Contacts that quote your birthday as "identity checks"; guessing passwords based on birthdays
→ Knowing your birthday is not proof of identity / do not use it in passwords
Described as not leaked or not confirmed
- Credit card data (not held in the affected systems)
- Purchase histories, MY Bookshelf (no leak, loss or damage confirmed)
- Passwords in the 4.2 million log-file records
Items confirmed as leaked (company notices)
- Email address
- Nickname, date of birth, gender
- Hashed password (the 319 member database records)
A date of birth cannot be changed. Stay alert for some time to fake emails using this incident as a pretext and to contacts that quote your birthday. How to check whether your email address appears in other leaks is covered in How to check whether your password leaked.
For people who run services that handle user data
The company has not disclosed the intrusion route or attack method, so this section does not say how to prevent this. It is not an assessment of the company's response. What the notices do show is that far more records leaked from system log files (up to about 4.2 million) than from the member database (319). The points below are limited to what can be reviewed in advance in light of that.
Check actual log files for personal data
In the fourth report, most of the leaked records were in system log files. In general, logs that record how a system behaves can end up holding email addresses, dates of birth and other input as they are, without anyone intending it.
Rather than relying on design documents, search the log files actually stored for strings shaped like email addresses or dates of birth. If you find any, mask them before they are written, or stop logging those fields.
Set a retention period for logs and limit who can read them
Logs are needed for investigations and troubleshooting, but keeping old ones raises the number of records exposed in a leak. Set a retention period and delete or move logs once it passes.
Limit the people and systems that can read logs, as you would for the production database. Check that the place where logs are kept does not have looser permissions than the database.
Be ready to state which place held which items
The company announced counts and items separately for the member database and the log files, and whether passwords were included also differed by place.
Keeping a list of which systems and files hold which items lets you tell affected people what to do quickly and accurately after an incident. How passwords should be stored is covered in What is password hashing?
Sources (public record)
The facts in this article are based on the public information below. The undisclosed intrusion route and attack method have not been guessed at.
- NTT Solmare Corporation, "Emergency maintenance of Comic Cmoa (first notice)" (Japanese, October 15, 2026) — nttsolmare.com
- NTT Solmare Corporation, "Apology and request regarding the leak of Comic Cmoa member data (second report)" (Japanese, October 16, 2026) — nttsolmare.com
- NTT Solmare Corporation, "Report on the leak of Comic Cmoa member data (third report)" (Japanese, October 18, 2026) — nttsolmare.com
- NTT Solmare Corporation, "Report on the leak of Comic Cmoa customer data (fourth report)" (Japanese, October 21, 2026) — nttsolmare.com
- NTT Solmare Corporation news release list (Japanese; checked October 23, 2026; nothing newer than the fourth report) — nttsolmare.com
- Comic Cmoa, "Notice and apology regarding the suspension of Comic Cmoa" (site notice, Japanese, undated; checked October 23, 2026) — cmoa.jp
Update history
2026-10-23: First version, based on NTT Solmare's first notice (October 15) to fourth report (October 21), its news release list and the Comic Cmoa site notice (checked October 23). The contact details in the first notice and second report were added after publication (confirmed in Internet Archive captures; the substance did not change). This article will be updated when the service resumes or a follow-up is published.
Read next
- Passwords: How to check whether your password leaked / Choosing and using a password manager / Which 2FA method is safest?
- Protecting yourself from follow-on scams: What phishing is
- Incidents from the same period: Carsensor.net and C-MATCH breach / Bookoff member data breach
- Other 2026 incidents: Data breaches and cyberattacks list
FAQ
QWhat leaked from Comic Cmoa?
According to NTT Solmare's fourth report of October 21, 2026, two sets of data were confirmed as leaked. One is 319 records of registration data in the member database: email address, hashed password, nickname, date of birth and gender. The other is up to about 4.2 million records in system log files: email address, nickname, date of birth and gender. The log-file records contain different items for different people and do not include passwords. Both are described as data confirmed as leaked.
QAm I affected?
The company says it will promptly email the people covered by the 319 database records and the up to about 4.2 million log-file records. It has not said which members fall into which group. The 4.2 million figure is a count of records, and the company says it may include duplicates for the same person. Even if you have not received an email, it is worth changing the password of any other service where you use the same email address and password.
QAre passwords or credit cards affected?
According to the company, hashed passwords (passwords converted into a form from which the original cannot be read) leaked only for the 319 member database records; the up to about 4.2 million log-file records do not include passwords. The company asks anyone who uses the same email address and password combination on other services to change the password there. It says credit card data is not held in the affected systems and did not leak, and that no leak of purchase histories and no leak, loss or damage of MY Bookshelf has been confirmed.
QWhat caused it?
The company gives the cause as unauthorized access by a third party. In its third report it said it had identified the intrusion route and attack method and was dealing with them, and in its fourth report that identifying and blocking them is complete, but it has not disclosed what the route or method was. It says it is investigating together with an outside specialist organisation.
QWhat if I get an email claiming to be Comic Cmoa or NTT Solmare?
The company warns that suspicious emails may arrive that misuse the leaked data, pose as the company and lead to fake websites. It asks people not to open URLs or attachments in unexpected emails and not to enter personal data or passwords on suspicious sites. Affected people will also receive genuine emails from the company. Do not use links in an email; check the content on NTT Solmare's news release page, opened yourself.
QWhen will the service resume, and what about subscriptions and points?
As of the fourth report on October 21, the company says it is coordinating the timing with the relevant bodies and will announce it once fixed. It plans to resume in stages, giving top priority to web reading of purchased titles and reading in the unlimited-reading service. For the unlimited-reading service and monthly plans, fees are basically not charged automatically for the period the service could not be used; people charged through some payment methods will be handled individually. For points that expired during the suspension, it says it is considering re-granting them when the service resumes.