KOMOJU review After October 2026 Unauthorized Access Exposing API Credentials

KOMOJU, a multi-channel payment platform used by merchants including those on Shopify, reported unauthorized access that began on the night of October 13, 2026. Attackers entered through a non-production environment and moved laterally, gaining views of merchant API credentials and transaction data. A second disclosure on October 26 detailed separate access to the CRM system holding inquiry records.

The incident affected roughly 4,100 records from the payment and decision system, mostly limited to email addresses with a small number including names and phone numbers. CRM exposure included merchant, partner, and consumer inquiries containing names, emails, inquiry histories, and in limited cases phone numbers, addresses, dates of birth, bank details for refunds, or ID documents. Card storage systems remained isolated with no access confirmed.

KOMOJU Security Incident Details

Initial detection occurred on October 14, with public notice on October 22 and follow-up details on October 26. KOMOJU stated that the card storage system was not reached and confirmed no leakage of payment card information. Temporary disruptions hit some payment methods such as certain Shopify integrations, konbini, and Pay-easy during the response period, though core services stayed operational under monitoring.

Merchants received no account suspensions. KOMOJU indicated it would notify affected parties individually and advised against responding to any email requests for credentials. The company planned regulatory reports for the CRM portion while continuing its investigation as of October 27.

Key facts from the incident include:

• Entry point: vulnerability in non-production environment
• API credentials viewed for some merchants
• CRM access via stolen system-to-CRM API keys
• No confirmed exfiltration of full customer lists or credit card data
• Secondary misuse such as fraudulent payments not reported

Impact on Merchants and Data Exposure

The two affected systems differed in scope and data sensitivity. The payment system exposure centered on operational records, while the CRM incident involved support and inquiry histories. Merchants using KOMOJU should review any individual instructions issued by the company regarding API key rotation.

No widespread secondary damage has surfaced in official updates. KOMOJU continues to monitor and has emphasized that it never solicits credentials by email. Merchants relying on the platform for international or multi-method payments may want to maintain separate logging of API activity during the ongoing investigation.

Current Trust Assessment for KOMOJU Users

Users evaluating whether KOMOJU remains suitable after the incident should note the separation of card storage from the accessed systems and the absence of confirmed data misuse. The company has issued direct notifications to impacted merchants and committed to further updates as the scope investigation concludes.

Practical steps include monitoring official KOMOJU channels for any follow-up instructions, rotating API keys where advised, and reviewing transaction logs for anomalies. As of October 27, 2026, services continue with added monitoring and no reported account-level actions against merchants.