I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. NTT Solmare's Comic C-MoA notice has two numbers. The 4.2 million matters least (company caveat: the logs may duplicate users). The 319 emails carry hashed passwords; fear those.
The numbers behind the fourth notice
Comic C-MoA is a major Japanese ebook store; Nikkei puts its monthly user base above 40 million. The fourth notice landed on 21 October, six days after the store halted all service at 11:35 JST on 15 October. The second notice (16 October) confirmed a member-data leak; the third (18 October) said system log files had been viewed and taken. The fourth turns those "under investigation" counts into concrete numbers, with the rocket-boys security lab filling in the timeline that evening.
The member database lost 319 records. The fields: email address, hashed password, nickname, date of birth, sex. The notice explains hashing as storing the password in a form where the original cannot be read. That is a delay, not safety. A weak password can still be cracked out of a hash.
Then the log files: up to about 4.2 million records, holding email addresses, nicknames, dates of birth and sex, with no passwords at all. Not every record holds every field, and the company's own caveat stands: the count may include duplicates of the same user, so it is a record count, not a count of unique people.
Two negatives matter. The affected system never held credit card information. Purchase history did not leak, and MY bookshelf data neither leaked nor was damaged. NTT Solmare says the attack path and method have been identified and containment is complete, but the technique stays undisclosed. The company will contact affected users individually by email.
No resumption date yet. On resumption every user must reset their password; readily viewed works and the unlimited-reading service return first, purchases and payment functions after further safety checks. Unlimited-reading and monthly-plan members should not be billed for the dead period, and points that expired during the outage may be reissued. That settles the money questions. It does not change the security picture.
Two columns, because the notice draws the line itself: what the investigators confirmed, and what nobody has said yet.
| Confirmed | Still unknown |
|---|---|
| 319 member records: email, hashed password, nickname, date of birth, sex | How many unique people sit behind the ~4.2M log records |
| Up to ~4.2M log records: email, nickname, date of birth, sex, no passwords; the company's own duplication caveat applies | Whether the 319 member records overlap with the log records (possible per the rocket-boys analysis; the notice does not say) |
| Service stopped 15 October at 11:35 JST after suspected unauthorised access | When the intrusion began |
| Attack path and method identified; containment complete | The attack technique, deliberately undisclosed |
| No credit cards held; purchase history and MY bookshelf intact | Whether any of the leaked data has been misused or traded |
| All users must reset passwords on resumption | The resumption date, and how the forced reset will work |
The big number cannot be replayed
Every headline will carry 4.2 million, and the notice deflates it fast. Logs are verbose: one person browsing the store can leave many rows, and the company gave no deduplicated count. So the figure measures the attacker's reach into the logging system, not a victim count.
Then the contents. No passwords. Emails, nicknames, dates of birth, sex, with fields varying from record to record. That is still personal data, and still useful for phishing. But nothing in it can be typed into another site's login form.
And the figure is an upper bound: "up to" about 4.2 million records, the maximum the investigators could not rule out. With the company's duplication caveat on top, the wide reading is the correct one: a large reach into the logs, an unknown number of people, no passwords. The notice confirms the leak. It does not confirm misuse.
The 319 that can
Each of the 319 is a complete login record: an email address paired with a hashed password, plus the nickname, date of birth and sex that make a phishing message feel personal. Hashing slows an attacker; it does not stop one who works the weak passwords out of the file first, and a hash is only as strong as the password behind it.
The tell is in what NTT Solmare asked victims to do. The notice explicitly tells anyone who reused the same email and password combination on other services to change it there. Companies write that sentence when they expect the pairing to be replayed. Replay needs two halves. The up-to-4.2M log records, a record count and not a count of unique people by the company's own caveat, have no passwords, so they cannot be replayed. The 319 have both halves. That asymmetry is the whole story.
This is also the part with a live phishing pipeline attached. NTT Solmare is emailing affected users individually, and attackers now hold the exact fields the genuine notice will reference: nickname, date of birth, sex. A forged company notice that greets you by nickname no longer takes any skill to write. This is how phishing uses your leaked email: your own details, read back to you, doing the attacker's credibility work for them. The company warns about exactly this: suspicious mail impersonating the company or its partners, and fake sites asking for personal information.
NTT Solmare is contacting affected users by email, and the attackers hold the nickname, date of birth and sex fields the real messages will reference. Do not click a link in any message about this breach. Go to the NTT Solmare notice yourself. A message that reads your own details back to you proves it has the file, not that it is the company.
One address per manga store
The email address you gave Comic C-MoA is the one field in this leak you could have made worthless to everyone but the store. An email alias dedicated to the manga store, forwarding to your real inbox, removes the cross-site pairing the attacker needs. That is what I built AliasFleet for: managed, persistent aliases, one per site. Not disposable addresses.
Picture the replay attempt with the alias in place. The attacker cracks a weak password and pairs it with the Comic C-MoA alias. They type that pair into a dozen other sites. Nothing matches anywhere. The email half works on exactly one site, because the alias was never typed anywhere else. Credential stuffing runs on the assumption that your address is the same everywhere. A per-site alias breaks that assumption at the root.
Then there is tracing. A phishing message landing on the Comic C-MoA alias tells you immediately which company's breach is feeding it, because nobody else ever had that address. That is the leak-tracing mechanism doing exactly what it exists for. And the setup guide takes about two minutes.
One limit, stated plainly: an alias does not change your nickname, your date of birth or your sex, and it cannot stop a company from writing those fields into a log file. What it protects is the replay path. In this breach, the replay path is where the real danger sits.
If you read manga on Comic C-MoA, do this
- Change the reused passwords first. If your Comic C-MoA email and password matched anything on another site, change them on the other site now. That pairing is the attack the company's own notice warned about.
- Expect impersonation mail and do not click it. The company is contacting affected users by email, so go to the official NTT Solmare notice yourself instead of following any link in a message about this breach.
- Take the forced reset when it comes. Every user must reset their password on resumption. Use a password you have never used anywhere else.
- Watch for phishing that knows your nickname. Your nickname plus your birthday is enough to make a fake support message feel personal. Anyone reading your own details back to you is proving they have the file, not that they are NTT Solmare.
- Turn on two-factor authentication on your email account. Leaked names, birthdays and email addresses are the raw material of account-recovery flows. 2FA is the part the attacker cannot talk their way past.
- Check Have I Been Pwned once the incident is listed, and walk the breach-response order of operations.
What NTT Solmare still has not said
Three things to watch. First, whether the 319 hashed passwords get cracked at scale, which would surface as credential-stuffing waves against other Japanese services. Second, whether the attack technique gets disclosed: the path is identified and contained, but every other ebook store is betting its own incident response on details it cannot see. Third, the resumption mechanics: the date, how the forced reset actually works, and what happens to accounts that never complete it. The notice confirms the leak. It does not confirm misuse. The same week brought Lawson's confirmation of a 2.155 million-member breach: Japanese consumer platforms are having a rough October.
