For: people who are friends of the official LINE accounts of the Keihan Group (Keihan Densha Fan Information, Kyoto Tower Sand, Hirakata Mall, Keihan Department Store, THE THOUSAND KYOTO, Kyoto Century Hotel), Kintetsu Real Estate's Paradi Gakuenmae, or Human Adjust. The provider says multiple companies and organizations were affected, so official LINE accounts other than those named here may also be in scope. This article is an explanation based on the companies' official notices; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who are friends of the official LINE accounts of the Keihan Group (Keihan Densha Fan Information, Kyoto Tower Sand, Hirakata Mall, Keihan Department Store, THE THOUSAND KYOTO, Kyoto Century Hotel), Kintetsu Real Estate's Paradi Gakuenmae, or Human Adjust. The provider says multiple companies and organizations were affected, so official LINE accounts other than those named here may also be in scope.
- Confirmed so farSee the table ↓
- Occurrence and blocking of the unauthorized access
- Leak of customer information
- Friend data (display name, profile image, LINE user ID)
3 more
- Friend data at Kintetsu Real Estate
- Status message
- Cause: credentials of an internal account obtained
Listed as possibly affected
- Friend data at Keihan and Human Adjust
- Name, phone number, email address, address, date of birth, gender
- Not yet confirmed
- Cause (how the credentials reached a third party)
- Final number of affected people at each company (currently maximums)
- Individual notices to affected people
2 more
- Announcements by other companies using the tool
- Whether the data has been misused
- What to do nowSee the steps ↓
- Do not open links in messages that claim to be an official LINE account or one of these companies
- Check the notices for the official accounts you are a friend of
- Depending on what you gave them, prepare for impersonation by phone, text message and email as well
2 more
- If you are worried, contact the point of contact in the notice
- If you entered information or sent money, get help right away
- Where to verify (source)All sources ↓
- Keihan Holdings, "[Apology] Apology and notice about the leak of customer information" (November 14, 2026, in Japanese)
- Last checked
- As of November 15, 2026
Follow-up plans and what we checked
The provider says it will promptly report what the investigation finds. Keihan Holdings says that, as soon as preparations are ready, it will report to the Personal Information Protection Commission and contact customers whose information leaked. Human Adjust says it is proceeding with its report to the Commission and will announce the results and scope once they are known. When we checked the companies' notices on November 15, 2026, we found no follow-up after them.
What friends of the official LINE accounts should do today
Do not open links in messages that claim to be an official LINE account or one of these companies
The provider warns of suspicious emails, text messages, LINE messages and calls that pretend to be the provider or the companies using its tool. Kintetsu Real Estate also says suspicious LINE messages pretending to be the company may arrive. Human Adjust asks people to be careful with suspicious emails and notifications.
Do not open the link in a message that rushes you, such as "confirm your membership information", "your points will expire" or "you have won". Check from a bookmark of the official site or from the official app. How to tell the difference is covered in What is phishing?.
Check the notices for the official accounts you are a friend of
The table below lists what the three companies whose official notices we could confirm say. If you recognise the name of an official LINE account (Keihan Densha Fan Information, Kyoto Tower Sand, Hirakata Mall, Keihan Department Store, THE THOUSAND KYOTO, Kyoto Century Hotel, Paradi Gakuenmae), check that company's notice to see whether the items you registered are included.
The provider says the information of multiple companies and organizations was obtained, so official accounts not listed here may also be in scope (our view). Follow any individual notice a company sends you.
Depending on what you gave them, prepare for impersonation by phone, text message and email as well
For the companies where at least one of name, phone number, email address, address, date of birth and gender is included (Keihan Department Store, Keihan Hotels & Resorts, Hirakata Mall, Kyoto Tower Sand (at least one of name and address, up to 9 people), Kintetsu Real Estate, Human Adjust; the items differ by company), channels other than LINE can generally be used too. Do not respond to a call or text message in a company's name that tries to get you to state your date of birth or address as "identity verification"; contact the company yourself through its official channel.
If you are worried, contact the point of contact in the notice
Kintetsu Real Estate lists the Gakuenmae office (Asset Business Division, Leasing Department) at 0742-41-3535 (9:00 to 17:50, closed on weekends and holidays; open on November 14 and 15). Human Adjust directs enquiries to official@human-adjust.co.jp. We found no contact point in Keihan Holdings' notice.
Use the contact in the official notice, not a number or link in a message.
If you entered information or sent money, get help right away
If you entered a password or card number at a link, or sent money, contact your bank or card company at once. You can also consult the police advice line (#9110) or the Consumer Hotline (188). How to check an account for suspicious activity is in How to check for unauthorized access.
What happened (from the provider's and the companies' notices)
The provider of the cloud-based delivery tool used to run LINE official accounts published a notice on November 12, 2026. What follows is the content of its notice. The companies' notices name the tool "COMSBI (SaaS version)".
November 9, 23:04
A third party logged in to the tool using one of the provider's internal accounts for operations and support, and began obtaining information of multiple companies and organizations.November 10, 02:15
The third party used several other internal accounts as well and expanded the collection.November 10, 07:36 to 09:17
The provider detected an anomaly in its cloud environment and blocked the permissions that had been misused. From about 09:00 to 09:17 it blocked the source of the access, changed the internal accounts' passwords and forced a logout.November 11 to 12
Keihan Holdings and Human Adjust say they were informed by the provider on November 11, and Kintetsu Real Estate says it was informed by its contractor on November 12. The provider published a notice on its website on November 12.November 13 and 14
Kintetsu Real Estate and Human Adjust published their scope on November 13, and Keihan Holdings on November 14.
- Occurrence
- From 23:04 on November 9, 2026 into November 10. The credentials of internal accounts used for operations and support were improperly obtained
- Leaked information (the provider)
- Information about users managed by some of the companies and organizations using the tool (name, phone number, email address, address, date of birth, gender and so on; items differ by company). Information about friends of LINE official accounts (LINE display name, profile image, status message, LINE user ID). The provider's cloud environment was also accessed without authorization, and its system configuration and credentials were obtained
- Not included
- Credit card information (the tool does not hold it)
- Cause (the provider)
- Insufficient management of the internal accounts' credentials. The accounts had permission to operate the admin functions of multiple companies and organizations. How the credentials reached a third party is under investigation
- Response (the provider)
- Blocked the access, changed the internal accounts' passwords and forced a logout, renewing credentials such as those used to link LINE official accounts (in progress), and limited access that pulls large amounts of data in a short time. It will make two-factor authentication mandatory on the admin screen and restrict connection sources, among other measures. The tool remains available
The three companies whose official notices we confirmed
All counts are each company's current maximum and may decrease after further investigation. Because the figures may overlap, this site gives no total. The LINE user ID is separate from the LINE ID used to search for friends.
| Company (date announced) | Official LINE account | Count and items (from each notice) | Status |
|---|---|---|---|
| Keihan Holdings (Nov 14) | Keihan Densha Fan Information (Keihan Electric Railway) | LINE display name, profile image (URL), LINE user ID: up to 26,914 people | Possible (the company) |
| Same | Kyoto Tower Sand (Keihan Ryutsu Systems) | At least one of name and address: up to 9 people. LINE display name, profile image (URL), LINE user ID: up to 90,550 people | Possible (the company) |
| Same | Hirakata Mall (Keihan Ryutsu Systems) | At least one of date of birth and gender: up to 35,025 people. LINE display name, profile image (URL), LINE user ID: up to 46,957 people | Possible (the company) |
| Same | Keihan Department Store | At least one of name, phone number, email address, address, date of birth and gender: up to 28,000 people. LINE display name, profile image (URL), LINE user ID: up to 51,223 people | Possible (the company) |
| Same | THE THOUSAND KYOTO and Kyoto Century Hotel (Keihan Hotels & Resorts) | At least one of name, phone number, address, date of birth and gender: up to 1,298 people. LINE display name, profile image (URL), LINE user ID: up to 8,742 people | Possible (the company) |
| Kintetsu Real Estate (Nov 13) | Paradi Gakuenmae | Friend data of the LINE official account (LINE display name, profile image (URL), LINE user identifier): up to 3,716 records. Information about users (address, gender): up to 137 records | Leak confirmed (the company) |
| Human Adjust (Nov 13) | Name of the official LINE account not stated | Information about users (including at least one of name, phone number, email address, address, date of birth, gender): up to 58,510 people. Friend data of the LINE official account (LINE display name, profile image (URL), LINE user ID): up to 116,518 people | Possible (the company) |
Keihan Holdings says that people registered to several accounts may be counted more than once, and that no leak other than those listed has been confirmed. The press reports the Keihan case as "up to about 220,000 people", which appears to be the sum of the per-account figures the company gives; the company's own notice contains no total.
What is known and what is not
This is based on the provider's and the three companies' notices, as of November 15, 2026. We will rewrite the status column when follow-up notices appear.
| Item | What the notices say | Status |
|---|---|---|
| Occurrence and blocking of the unauthorized access | Began at 23:04 on November 9; blocked during the morning of November 10 (by 09:17) | Confirmed (provider) |
| Leak of customer information | The provider says information of multiple companies and organizations was obtained | Leak confirmed (provider) |
| Friend data (display name, profile image, LINE user ID) | The provider lists it among the leaked information | Leak confirmed (provider) |
| Friend data at Keihan and Human Adjust | Each says it "may have leaked" | Possible (each company) |
| Friend data at Kintetsu Real Estate | The company says it "was found to have leaked". The count is under investigation | Leak confirmed (the company) |
| Name, phone number, email address, address, date of birth, gender | The provider says items differ by company. Each company's scope is in the table above | Possible (each company) |
| Status message | The provider lists it among leaked information, but it is not among the items in the three companies' notices | Leak confirmed (provider) |
| Credit card information | The provider says the tool does not hold it. Keihan Holdings' notice also says the service does not hold it | Not included (provider) |
| LINE password and chat history | Not among the items in the notices | Not stated |
| Cause: credentials of an internal account obtained | The provider says its management of them was insufficient | Confirmed (provider) |
| How the credentials reached a third party | The provider says it is under investigation | Under investigation |
| Misuse | Keihan Holdings says no secondary harm has been confirmed. Not stated by Kintetsu Real Estate or Human Adjust | Not confirmed (Keihan Holdings) |
| Individual notices and report to the Personal Information Protection Commission | Keihan Holdings: once preparations are ready. Human Adjust: when it identifies affected customers, and the report is in progress | Planned (stated by each company) |
| Overall number of people affected | The provider has not published a count | Not stated |
What can happen with friend data and customer information
The table below shows what can generally happen with combinations of these items. It does not mean that any of this happened in this incident.
| Item that may have leaked | What can generally happen | What registrants should do |
|---|---|---|
| LINE display name + profile image + LINE user ID | It becomes known which company's official LINE you are a friend of (LINE passwords and chat history are not among the listed items) | Check on the official website before opening a link |
| Name + phone number + email address | Realistic-looking calls, text messages and emails in the company's name | Contact the company yourself through its official channel |
| Address + date of birth + gender | Attempts to draw out the remaining details under the label of "identity verification" | Do not answer even if the caller states your date of birth correctly |
| Friend data + a service that uses membership or points | Lures made to look like "points expiring" or "membership check" | Check balances and notices in the official app |
What can happen with information that may have leaked
- Realistic messages with links that pretend to come from an official LINE account
- Impersonation calls, text messages and emails from someone who knows your name, phone number and address
- Contacts that draw out your date of birth or address as "identity verification"
What is outside the scope, or not stated, within the notices
- Credit card information (the provider's and Keihan's notices both say the service does not hold it)
- LINE passwords and chat history (not among the items in the notices)
- The LINE ID used for searching (separate from the LINE user ID)
A separate case at the same provider: another platform (October 23)
On October 26, 2026 the same provider also announced unauthorized access (on October 23) to a different system platform that it provides individually to corporate customers. The November 12 notice says this other platform is not affected, and the companies' notices refer to the cloud-based tool. In a follow-up on November 9, the provider said it had confirmed that the credentials of the LINE official accounts (channel access token and channel secret) of some customers using that other platform had been read. It says it has not confirmed that the information was actually obtained, and has received no report of misuse.
This article covers the November 12 notice and the companies' notices that followed. Friends of companies using the other platform can use the same precaution (check a message that asks for input through a link on the official website). Kintetsu Real Estate has also announced a separate matter in early November, involving a contractor's email delivery service. The email delivery case is covered in Unauthorized access to the Arara Message email delivery service.
What operators should review: contractors' admin accounts and the items you hold
The cause is still under investigation, so we write only what the published facts support.
- Check the permissions of your contractor's operating accounts: according to the provider's notice, one internal account had permission to operate the admin functions of multiple companies and organizations, so the information of several companies was obtained. Companies using such a tool can limit the impact of a similar incident by confirming in the contract and the specifications with what permissions the contractor's operators can enter your admin screen, and whether two-factor authentication is mandatory.
- Decide the contact route in advance: Keihan Holdings and Human Adjust were informed on November 11 and Kintetsu Real Estate on November 12, which is around the provider's own announcement on November 12. Deciding beforehand who receives an incident report from a contractor and how the notice to users is decided can shorten the time to disclosure.
- Review the items you keep in friend management: some companies hold date of birth and gender in their LINE friend management, and those items were included among the information that may have leaked. In general, not keeping items that are not needed for delivery, or managing them separately, reduces what leaks from one compromise.
Sources (public record)
The facts in this article are based on the official notices below. We have not speculated about details of the cause that have not been disclosed.
- Keihan Holdings, "[Apology] Apology and notice about the leak of customer information" (November 14, 2026, in Japanese) — keihan.co.jp (PDF)
- Kintetsu Real Estate, "Apology and notice about the leak of LINE registration information due to unauthorized access to a LINE delivery service at a contractor" (November 13, 2026, in Japanese) — kintetsu-re.co.jp (PDF)
- Human Adjust, "Notice (apology) about the possible leak of personal information due to unauthorized access to a contractor's cloud service" (November 13, 2026, timely disclosure, in Japanese) — release.tdnet.info (PDF)
- [LINE delivery tool provider], "Notice and apology about the leak of personal information due to unauthorized access to its cloud-based service" (November 12, 2026, in Japanese) — sonicmoov.com
- [LINE delivery tool provider], "Notice about unauthorized access to a platform provided individually to corporate customers (follow-up)" (November 9, 2026, in Japanese) — sonicmoov.com
- [LINE delivery tool provider], "Notice and apology about possible information leakage due to unauthorized access to a platform provided individually to corporate customers" (October 26, 2026, in Japanese) — sonicmoov.com
Update history
2026-11-15: First version. Based on the provider's notice of November 12 and the official notices of Keihan Holdings (November 14), Kintetsu Real Estate and Human Adjust (November 13). We checked the companies' notices the same day and found no follow-up. Announcements by other companies whose official notices we could not read are not included in the table.
Read next
- A similar incident through a contractor: Unauthorized access to the Arara Message email delivery service
- How to spot fake contact: What is phishing? / Smartphone security basics
- Suspicious activity on an account: How to check for unauthorized access
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)