SHINDO4

Komitto Shaken

Cosmo Oil Marketing Co., Ltd.

Customer phone numbers~176,000records

EXPOSEDPhone number / Full nameMisconfiguration · Contained

Open in the live monitor ▶
Disclosed
Jun 23, 2025
Detected
May 30, 2025
Detection to disclosure
24 days
Leak
Exposed, access unknown
Type
Misconfiguration
Status
Contained
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityCustomer name, Names of assigned mechanics
ContactCustomer phone number
Account dataCustomer ID number
Transactions & activityVehicle information

How many

  • Customer phone numbers ~176,000 records
  • Customer ID numbers ~165,000 records
  • Vehicle records ~119,000 records
  • Customer names ~35,000 records
  • Names of assigned mechanics ~3,000 records

Who is affected

  • Komitto Shaken customers
  • Assigned mechanics

Cause

Files stored in the cloud could be accessed from outside by entering their URL directly

Timeline

  1. Exposure began
  2. Detected
  3. Exposure ended
  4. Date of the Security NEXT report

Response

  • Config review
  • Notified individuals

Changed the settings to block access and notified affected customers through the company's official app

What you should do

  1. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  2. Check the company's notice to see if you're affected

Lessons for companies

  1. Two-person review and pre-release tests for sharing and cache changes; monitor cloud config (CSPM)
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources