Partial service resumed on October 29; service has been down since October 15 due to unauthorized external access
Image via Comic CMOA's X/Twitter account ©NTT Solmare Corporation
NTT Solmare announced on Thursday that its Comic CMOA manga service has partially resumed service, after it suspended service for maintenance for almost two weeks due to an unauthorized external access.
As of Thursday, some features of the service have resumed, including: viewing of purchased works via web browser, use of unlimited reading service via web browser, changing member information, request for cancellation of registered monthly plans, and request for cancellation of registered unlimited reading services. The company noted that members have to reset their password to be able to use the features.
The service's bookshelf function is scheduled to resume soon, and the function to purchase works and points is scheduled to resume sequentially for each payment method. Other functions that have not resumed yet are automatic purchase of new releases, unsubscribing from the site, new member registration, and checking of history records such as points, purchases, and monthly subscription.
NTT Solmare urged users to be cautious of suspicious emails and other communications, and also urged users to change their password on any other service that used the same combination of email and password.
Meanwhile, members who use the service outside of Japan still cannot access the website due to its access restriction from outside Japan and via VPN (Virtual Private Network). This issue was not mentioned in NTT Solmare 's latest announcement.
The service announced on October 15 an emergency maintenance, and gave an update that evening that there was a high likelihood of an unauthorized external access to its servers. The service confirmed the next day the unauthorized external access to its servers, resulting in information leakage of some its members. Leaked member information includes email address, date of birth, gender, nickname, and hashed password (a password that has been converted into a special string of characters, making it unreadable).
On October 18, the company stated that it has identified the cause of the unauthorized external access and is implementing preventive measures and preparing to resume services in collaboration with specialized organizations. The service noted that to resume services, additional steps are necessary to ensure further safety measures.
In addition to previously reported leaked information, the service has confirmed that certain system log files were also accessed and retrieved. In its update on October 21, the service confirmed that there are approximately 4.2 million affected entries in the accessed system log files. Affected entries include email address, nickname, date of birth, and gender, and may also include duplicate information about the same customer. The service also confirmed that 319 items of registration information on the member database have been leaked.
The service also assured that members' credit card information is not stored in the affected system and has not been leaked. Additionally, no purchase history and data in members' "My Bookshelf" section were confirmed to have been leaked or damaged, as to date.