KOMOJU Security Review After Mid-October 2026 Internal Systems Incident

KOMOJU security review focuses on the unauthorized access that began the evening of October 13, 2026. The company detected the intrusion early on October 14 and contained it the same morning by blocking access and patching the entry point in a non-production environment. Official statements confirm that payment processing systems and stored credit card data remained isolated from the breach.

What Data Was Exposed in the October 2026 Incident

The payment system exposure affected roughly 4,100 records, mostly limited to email addresses. A small subset also included merchant names and phone numbers. Some merchants received separate notices that their API credentials had been accessed; those accounts were individually contacted. No transaction amounts, order details, or item information left the system.

A separate CRM system breach disclosed partial inquiry records. The exact fields varied by record and could include email, name, phone, address, date of birth, bank account details, or identification documents. KOMOJU stated that no complete customer database or full lists were confirmed exfiltrated. Credit card information stayed in a separate, unaffected storage area.

• Payment system: primarily email addresses; limited names and phones
• CRM system: inquiry-specific fields such as address or ID documents
• Credit cards: no access confirmed
• Transaction data: none reported leaked

Notifications for affected individuals began October 29, 2026, and were scheduled to finish by mid-November. Merchants and customers can reach security-contact@komoju.com for specific questions; the address supports both English and Japanese.

Company Response and Ongoing Measures

KOMOJU published its first public notice on October 22, 2026, and a second update on October 26. Containment actions included disabling compromised sessions, applying patches, and tightening network access controls. The company also strengthened credential management and monitoring systems.

No fraudulent payments or secondary misuse have been confirmed as of late October 2026. An internal investigation continues and may take several weeks. KOMOJU indicated it is evaluating additional third-party audits under regulatory guidance. Temporary service interruptions, such as Shopify payment method issues, occurred around mid-October but were resolved separately from the data exposure.

Merchants relying on KOMOJU should review any direct notifications sent to their registered contacts. Updated security documentation is available in the official help center. Users concerned about privacy can monitor the listed email address for further updates.

Current Status and Practical Steps for Users

As of November 5, 2026, the immediate risks from the incident appear contained. Payment processing continues without evidence of card data compromise. Merchants who received API credential notices should rotate those keys and monitor connected accounts.

Customers whose inquiry records may have been involved will receive direct contact if their information matches the leaked scope. In the meantime, standard account monitoring for unusual activity remains advisable. The company continues to publish status updates through its help center articles.