The Komiko data breach is an alleged theft of the full database of the Komiko AI app. An unidentified actor claimed it on an underground forum in February 2026. The actor said it affected more than 1,000,000 registered users. The post says the leaked sample includes Google OAuth tokens, session tokens, personal identifiers, subscription records and account credentials.
Executive Summary
In February 2026, Brandefense threat analysts found a high-severity post on an underground forum. An unidentified threat actor claimed to have stolen the complete database of a popular AI-powered application. The actor said the breach affected more than 1,000,000 registered users. The actor offered the full dataset for free download, with a credit requirement attached. This is a way of sharing data that is often used to build a name within threat actor communities.
Our team examined the leaked data. It includes Google OAuth tokens, active session tokens, user-generated content, personal identifiers, subscription records, and account credentials. The exposure of OAuth tokens is a severe risk in particular. These tokens can be used to reach third-party services linked to the compromised accounts. That extends the blast radius far beyond the breached platform itself.
- Claimed by.
- Unidentified actor on an underground forum.
- When.
- February 2026.
- Claimed scale.
- More than 1,000,000 registered users.
- Data named.
- Google OAuth tokens, session tokens, personal identifiers, subscription records.
- Root cause.
- Not officially confirmed.
- Komiko statement.
- Says it does not store passwords or payment card data.
| ⚠ CRITICAL: Active Google OAuth and session tokens were found in the dataset. If valid, these tokens allow attackers to authenticate as victims without needing a password. |
What Was in the Leaked Database?
Our analysts reviewed a sample of the alleged dataset. The breach appears to cover many database tables exported in JSON format. This structure fits a direct database dump rather than a scraping or API abuse incident. Below is a breakdown of each exposed data category:
| Data Category | Fields Exposed | Risk Level |
| Account / OAuth Records | Google OAuth tokens, refresh tokens, access tokens, provider account IDs, token expiry timestamps | CRITICAL |
| Session Records | Session tokens, user IDs, expiry timestamps | CRITICAL |
| User Records | Full name, email address, username, profile picture URL (Google CDN), credit balance, invite codes, creation date, user unique IDs | HIGH |
| Subscription Records | Stripe customer IDs, subscription IDs, plan names, plan codes, credit allocations, expiry dates, billing source | HIGH |
| Verification Tokens | Email verification tokens, associated email addresses, expiry timestamps | HIGH |
| Messages / Content Records | User-generated content IDs, content type, host content references, aggregate IDs, creation timestamps | MEDIUM |
| User Badges | Badge assignments, user identifiers | MEDIUM |
| User Blocks / Shares | Block relationships, shared content records | LOW |
| Push Tokens | Device push notification tokens, user linkage | MEDIUM |
How Did the Komiko Data Breach Appear to Occur?
The root cause has not been officially confirmed. Still, the structure and completeness of the leaked dataset give useful forensic clues. Based on our analysis:
Database Dump Indicators
The exported files follow a consistent, relational database structure. Each table is exported as a standalone JSON array. This pattern fits direct database access through an ORM (Object Relational Mapper) export, a compromised backup file, or unauthorized administrative access. The data covers all major tables. That rules out a targeted API abuse scenario.
Why Does OAuth Token Exposure Matter?
The Account.json file contains what appear to be live Google OAuth access tokens and refresh tokens. OAuth tokens are temporary credentials that let applications act on behalf of a user.
A refresh token, if not revoked, can be used indefinitely to make new access tokens. This means attackers may keep persistent access to linked Google accounts even after the compromised platform rotates its own credentials.
⚠ IMPORTANT: Refresh tokens do not expire unless explicitly revoked by the user or Google. Any user who authenticated via Google OAuth on this platform should immediately revoke third-party access at myaccount.google.com/permissions.
What Is the Risk From Exposed Session Tokens?
Session.json contains active session tokens with future expiry timestamps (some extending to early 2026). Active session tokens can be used directly to hijack logged-in sessions without any credentials. This technique is known as session hijacking or cookie theft.
Stripe Customer ID Exposure
The Subscriptions.json file exposes Stripe customer IDs. Stripe customer IDs alone do not grant access to payment card data. But combined with a compromised Stripe secret key, they can be used to retrieve billing information or manipulate subscription states. Organizations using Stripe should rotate API keys immediately if this data is confirmed.
What Is the Impact of the Komiko Data Breach?
Organizational Impact
The alleged compromise is a significant reputational and regulatory risk for the affected platform. Under GDPR, CCPA, and other applicable data protection frameworks, the exposure of personal data triggers mandatory breach notification obligations. This includes email addresses, profile pictures, and unique identifiers. Failure to meet notification timelines can result in substantial regulatory fines.
The exposure of user-generated content, including AI prompts and generated media, raises additional privacy concerns. These records may reveal sensitive personal interests, business use cases, or private creative work. If publicly disclosed, each carries its own reputational risk for users.
End-User Impact
- Account Takeover: Active session tokens and OAuth refresh tokens can give immediate, logged-in access to victim accounts.
- Credential Stuffing: Exposed email addresses will be added to credential stuffing lists. They will be tested on other platforms where victims may reuse passwords.
- Phishing & Spear Phishing: Full name, email, and profile data enable highly personalized phishing campaigns with higher success rates.
- Identity Theft: Email, name, profile image, and account history together give enough data for synthetic identity fraud.
- Financial Risk: Exposed Stripe customer IDs, credit balances, and subscription details may enable subscription fraud or targeted billing manipulation.
- Cross-Platform Risk: Google OAuth tokens may expose other services connected to the same Google account. These include Google Drive, Gmail, Google Workspace, and third-party SaaS tools.
| Attack Vector | Likelihood | Potential Impact |
| OAuth Token Abuse / Account Takeover | Critical | Immediate account compromise across linked services |
| Session Hijacking | High | Direct access to active authenticated sessions |
| Targeted Phishing Campaign | Critical | Elevated open & click rates due to PII richness |
| Credential Stuffing Against Other Platforms | High | Password reuse exploitation across unrelated services |
What Has Komiko Confirmed in Its Official Statement?
- They acknowledged receiving a credible threat that an external attacker had accessed their database.
- They confirmed that user IDs, email addresses, and potentially user content had been compromised.
- They announced that they do not store passwords or payment card data.
- They stated that they worked with security experts and reported the incident to law enforcement.
Areas they said they are still investigating include:
- The full scope of the accessed data,
- How the attacker gained access,
- Whether user-generated AI content (AI creations) was included.
How Should Users and Organizations Respond?
For Affected Users — Immediate Actions
| If you have an account on the affected platform, take the following steps immediately: |
- Revoke Google OAuth access: Visit myaccount.google.com/permissions and remove the application’s access to your Google account.
- Change your password on the affected platform. Change it on any other service where you use the same password.
- Turn on Multi-Factor Authentication (MFA) on your Google account and any linked services immediately.
- Review your Google account’s recent activity (myaccount.google.com/security) for any unauthorized sign-ins.
- Watch for phishing emails sent to your registered email address. Attackers now have your name and account history.
- Monitor your linked payment methods for suspicious charges, particularly if you had an active subscription.
- Check if your email appears in additional breaches.
For the Affected Organization — Response Checklist
- Immediately rotate all Google OAuth client secrets. Force-revoke all existing OAuth tokens.
- Invalidate all active session tokens. Require all users to sign in again.
- Rotate Stripe API keys and audit all recent API calls for suspicious activity.
- Engage a forensic response team to find the root cause, timeline, and full scope of the compromise.
- Run an emergency security audit of database access controls, backup storage, and administrative account privileges.
- Implement IP allowlisting and privileged access management (PAM) for all database and cloud infrastructure access.
Strategic Recommendations
- Implement encryption at rest for all OAuth tokens, session tokens, and sensitive credentials stored in the database.
- Adopt a token rotation policy: short-lived access tokens (1 hour) with server-side refresh token validation.
- Deploy a Web Application Firewall (WAF) and database activity monitoring (DAM) to detect unusual bulk export patterns.
- Run regular penetration testing and red team exercises that target authentication and data access flows.
- Implement Data Loss Prevention (DLP) controls to alert on bulk data exfiltration events.
How Brandefense Detected This Threat
Brandefense’s continuous dark web and underground forum monitoring found this breach. Our platform maintains 24/7 automated surveillance across thousands of threat actor forums, leak sites, Telegram channels, and private marketplaces. This lets our analysts surface high-severity incidents within hours of the first post.
Upon detection, our Threat Intelligence team validated the claims. They analyzed the provided sample data and cross-referenced the exposed fields against known database structures. They also assessed the technical credibility of the actor’s claims.
| Detection Capability | Value Delivered |
| Underground Forum Monitoring | Breach post identified within hours of initial publication |
| Dark Web Data Validation | Sample analysis confirmed data authenticity and scope |
| Actor Profiling | Distribution model (free share + credit requirement) mapped to known reputation-building behavior |
| Impact Scoring | High-severity classification triggered based on OAuth token exposure and user volume |
