Two separate security incidents, one in Japan and one in Taiwan, have been confirmed this week. The Comic CMoa data breach affects one of Japan's biggest ebook stores, with email addresses and password hashes reported lost. Separately, ACCESS has confirmed that 1,305 card accounts were stolen from CROS. The two cases are unrelated, but together they show two common kinds of exposure: login credentials and payment card data.

The details available so far are limited, so this post sticks to what has been reported and explains what it means in practice.

What leaked in the Comic CMoa and ACCESS breaches

According to the reporting, the Comic CMoa data breach involves a popular Japanese ebook store, and the data lost includes user email addresses and password hashes. A password hash is a scrambled version of a password, not the password itself. Companies store hashes so they do not have to keep plain-text passwords on their servers.

The second incident is separate. ACCESS confirmed that 1,305 card accounts were stolen from CROS. The source describes the scale as 1,305 card accounts, and it does not provide further details in the material we reviewed. We are not going to guess at which fields were taken, how the attackers got in, or who was behind either incident.

It is worth stressing that these are two different companies, two different systems, and two different types of data. Readers should not assume that one incident is connected to the other.

Why hashed passwords still put users at risk

Hearing that only hashes were taken can sound reassuring, but it should not make anyone relax. Hashes are a layer of protection, not a guarantee. How safe a hashed password is depends on how strong the original password was and how the service hashed it.

If an attacker obtains a set of hashes, they can try to work backward by guessing common passwords, hashing each guess, and comparing the results. Short, predictable, or commonly used passwords tend to fall first. Strong, unique passphrases are much harder to recover.

The email addresses matter too. Even without any password, a list of emails tied to a specific service can be used for targeted phishing, such as fake messages claiming to come from the ebook store and asking you to log in again.

The biggest practical danger is password reuse. If you used your Comic CMoa password on another site, anyone who cracks that hash could try the same email and password combination elsewhere. This is known as credential stuffing, and it works only when people reuse passwords.

What the CROS card theft means for affected customers

Card data is a different problem. With 1,305 card accounts reported stolen from CROS, the main concern for affected customers is unauthorized charges and fraud attempts. Card issuers generally have processes for replacing compromised cards and disputing fraudulent transactions, but they can only act if you notice a problem or are told about it.

If you are contacted by ACCESS or your card issuer about this incident, treat the notice seriously, but verify it first. Breaches are often followed by scam messages that imitate the affected company. Use contact details printed on your card or taken directly from the company's official website, not links in an unexpected email or text.

Small test charges are a common sign of card misuse, so even minor transactions you do not recognize deserve a call to your issuer.

Steps to protect your accounts after a breach

You do not need to panic, but a few quick actions go a long way:

  • Change reused passwords. If your Comic CMoa password was used anywhere else, replace it on every other account. Make each one unique.
  • Turn on two-factor authentication (2FA). Even if someone has your password, a second factor makes it much harder to get in. App-based codes or hardware keys are generally stronger than SMS.
  • Use a password manager. It can generate long, random passwords and remember them for you, which removes the temptation to reuse.
  • Monitor card statements. Check your accounts regularly, set up transaction alerts if your bank offers them, and report anything unfamiliar right away.
  • Be wary of follow-up messages. Do not click links in unexpected emails about either incident.

The same habits apply after any breach, including attacks where criminals aim to disrupt a victim directly, as in the case of an Akira ransomware affiliate whose attack backfired. Attackers make mistakes, but you should not count on that to protect your data.

What This Means For You

If you have a Comic CMoa account, assume your email address may be in the hands of third parties and that your password hash could eventually be cracked, especially if the password was weak. Change it, and change it anywhere else you used it. If you are connected to CROS or an ACCESS card account, watch your statements closely and confirm any communications through official channels.

If you are in neither group, these incidents are still a useful reminder. Most of the damage from breaches comes later, when stolen details are reused against people who did not change their habits.

Key takeaways

The Comic CMoa data breach and the ACCESS CROS card theft are separate events, but the advice is the same: act early. Replace reused passwords with unique ones, enable 2FA, store credentials in a password manager, and review your card activity regularly. Ten minutes of cleanup now is far easier than dealing with account takeovers or fraudulent charges later.