Comic CMOA Hack Explained: 4.2 Million Records Leaked and the Store Still Offline
Japan's Comic CMOA manga store has been offline since October 15 after a hack that leaked up to 4.2 million records. What leaked, what's safe, when you can read your books again and what account holders should do now.
| Category | Manga |
|---|---|
| Published | OCT 22, 2026 |
| Read time | 6 MIN |
The Comic CMOA hack has kept one of Japan's biggest digital manga stores offline since October 15, 2026, and up to about 4.2 million records of member information were leaked. NTT Solmare, the company behind Comic CMOA (コミックシーモア, also written Comic C'moA), gave the full numbers in its fourth report on October 21. Its store page still showed only a suspension notice when we checked on October 22. Here's what leaked, what didn't, when the store might come back and what account holders should do now.
- What: hackers broke into Comic CMOA, the Japanese digital manga store run by NTT Solmare.
- Offline since: October 15, 2026. No restart date yet.
- Leaked: 319 member records plus up to about 4.2 million log records (emails, nicknames, birth dates, gender; hashed passwords only in the 319).
- Safe: credit cards, purchase history and your library of bought books.
- Do now: change your password anywhere you reused it, and ignore emails asking you to log in.
What Happened to Comic CMOA?
Someone broke into Comic CMOA's servers from outside, and the company shut the whole store down to stop it. NTT Solmare is part of the NTT West group and launched C'moA in November 2003. It is a big business: the company reported about ¥87.1 billion in sales for the year to March 2026. Here is how the week went, based on the company's reports:
| Date (JST) | What happened |
|---|---|
| October 15 | NTT Solmare decides an outside attack on its servers is likely and stops the service at 11:35 a.m. |
| October 16 | The company confirms member information was leaked from its servers. |
| October 18 | Third report: the attack route and method have been identified and blocked. Some system log files were also viewed and taken. |
| October 21 | Fourth report: final counts of leaked data, the order in which services will return, and plans for subscriptions and points. |
| October 22 | The store is still offline. No restart date has been given. |
NTT Solmare hasn't said who was behind the attack or exactly how they got in, only that the route has been found and closed. The numbers it did publish are more specific.
What Data Was Leaked in the Comic CMOA Hack?
Two sets of data were leaked, according to the October 21 report:
| Source | Records | What was in them |
|---|---|---|
| Member database | 319 | Email address, hashed password, nickname, date of birth, gender |
| System log files | Up to about 4.2 million | Email address, nickname, date of birth, gender (no passwords) |
The 4.2 million figure is a count of records, not people. NTT Solmare says it may include the same customer more than once, and not every record contains every item. A hashed password is stored in a scrambled form rather than as the original text, which makes it much harder, though not impossible, to recover. The company says it will email everyone whose data was leaked.
What was not leaked matters just as much:
- Credit card details: not stored in the affected system, so not leaked.
- Purchase history: no leak confirmed.
- Your library ("MY本棚", My Bookshelf): no leak, loss or damage confirmed.
Your books are still there, but you can't read them yet. That is the part regular readers feel the most.
When Will Comic CMOA Come Back?
There is no date yet. NTT Solmare says it is still working with "relevant authorities" before it reopens, and it will bring the store back in stages, starting with the features it has checked:
- First: reading books you already bought, on the web, and reading in the 読み放題 (unlimited reading) subscription.
- Later: buying new books and the various payment methods, once each one is confirmed safe.
The fourth report also covers money. Monthly subscriptions should not be charged for the time the store was down; a few payment methods may still bill automatically, and the company says it will handle those customers one by one. Points that expire during the outage may be given back, and NTT Solmare says it is considering a further apology offer, with details at reopening. When the store does reopen, every member will have to reset their password. That's the official side. Account holders should act now rather than wait for it.
What Should Comic CMOA Users Do Now?
The biggest risk now comes from what attackers can do with the leaked emails, not from the store itself. Following NTT Solmare's own warnings:
- Change reused passwords. If you used the same email and password on any other site, change the password there now. Leaked email and password pairs are used to break into other services.
- Watch for fake emails. Expect phishing messages pretending to be Comic CMOA or NTT Solmare, especially ones about refunds, points or "reopening". Don't open links or attachments you weren't expecting, and never enter a password on a page you reached from an email.
- Wait for the official reset. The real password reset will be announced on NTT Solmare's site and Comic CMOA's official X account (@comic_cmoa) when the store reopens.
English-speaking readers have one more question, because the same company runs a U.S. store.
Is MangaPlaza Affected?
NTT Solmare also runs MangaPlaza, an English digital manga store it launched in the U.S. on March 1, 2022. Its reports on the attack only mention Comic CMOA, and MangaPlaza was loading normally when we checked on October 22. The company hasn't said anything about MangaPlaza either way. If you use the same password on both services, changing it is the safe move.
The bigger lesson isn't about one company. It's about what "owning" a digital manga really means.
How Safe Are Digital Manga Collections?
When you buy a digital manga, you are usually buying a license to read it inside one company's app. If the company goes offline, you can't read it, and if it shuts down for good, you may lose it. Comic CMOA is only the latest reminder:
- KADOKAWA and Niconico, June 2024: a ransomware attack claimed by the BlackSuit group took down Niconico and parts of KADOKAWA's business, and the personal data of 254,241 people was leaked. Niconico's main video service didn't return until August 2024.
- Tapas, October 2026: the webtoon and web fiction platform announced it will end service in March 2027, leaving readers without access to content they paid for.
- Comic CMOA, October 2026: no reported data loss for libraries, but no access to them for at least a week.
That doesn't mean digital is a bad deal. It is cheaper, takes no shelf space and gets many manga out faster. But for the series you love, a printed copy is the only version nobody can switch off. Here's my take.
Kairo's Take
Honestly, what a disaster. Up to about 4.2 million leaked records is huge, but the site being totally shut down is what really hurts regular users. It's every digital media buyer's worst nightmare: you pay for all these manga volumes, and the second the service gets hit, you can't even open the books you paid for. Plus, everyone with an account now has to deal with the anxiety of changed passwords, potential phishing scams and wondering what personal data leaked. Just a total mess, and a reality check on how fragile pure digital collections actually are.
For more on the business behind anime and manga, read how AI is causing fights in anime and how much of anime Sony now owns, or browse the latest manga news.
Sources: NTT Solmare's fourth report (October 21, 2026) and earlier reports, Impress Watch, Denfaminicogamer, Anime News Network, Wikipedia (Japanese) (company history and sales), Anime Corner (MangaPlaza launch), Wikipedia (KADOKAWA attack), Anime News Network (Tapas). Cover photo: Manga reader on the train by Gavin Anderson, via Wikimedia Commons, CC BY-SA 2.0, cropped.
Anime and manga fan writing honest reviews and industry news — one person, real opinions, no ghostwriting.
