Introduction
On October 9, 2026, Commune Inc. (コミューン株式会社), the Japanese company behind the online community platform Commune and its internal-use version Commune for Work, confirmed it had suffered unauthorized access. According to the company's notice, as summarized by INTERNET Watch, data on roughly 307,000 members of communities run by the platform's customers was leaked.
The case stands out because it did not hit just one company. Well-known brands use Commune for user forums, fan clubs and customer communities. Over the following days, Sansan, Yamaha, Suzuki, Koikeya, Morinaga Milk, Bandai Namco Experience and even Aomori Prefecture published their own notices about affected members.
This article sums up what has been confirmed, who was affected and, above all, what a small or medium-sized business in Japan can learn from it, whether it runs an online community or simply uses cloud services that hold customer data. All information comes from the sources listed at the end.
What happened, according to Commune
The timeline released by the company and reported by INTERNET Watch is as follows:
- October 5, around 6 p.m. JST: the unauthorized access to the services begins.
- October 6: Commune detects the attack, blocks the suspicious traffic and starts an investigation. Around 9 p.m., all communities are switched to maintenance mode and the company begins restoring data.
- October 7, from 1:17 p.m.: the attacker uses a communication path that was still open during maintenance to register and browse illegitimately. That path was blocked at 2:58 p.m. the same day.
- From October 8: after putting protective measures in place, Commune gradually reopens the communities whose customers asked to resume.
As for the cause, the company says a third party exploited flaws in Commune's own system. In practice, the attacker:
- improperly obtained invitation links to private communities and registered as a regular member;
- impersonated administrators to view and extract member data and to overwrite data.
Morinaga Milk stressed in its notice that the incident was caused by multiple flaws in Commune's system, not by Morinaga's own settings or operations.
How many people and what data
According to Commune's estimates:
- About 307,000 members had some data leaked.
- About 126,000 had data leaked including their email address. This group includes about 42,000 accounts belonging to Commune's own employees and demo accounts used for testing.
- About 181,000 had data leaked without an email address, such as display name, self-introduction and private group membership.
Two other company services, Commune CRM and Commune Engage, saw access attempts but no confirmed leak. For Commune Voice, Commune Navigator and Commune DataHub, no unauthorized access had been confirmed as of the notice.
Who was affected
The customers' notices give a sense of the scale. Some examples:
- Sansan ("Sansan User Forum"): confirmed leak for 1,325 members (email, display name, self-introduction, profile picture and groups) and a possible leak for another 8,687 members (the same data, without email). Sansan said passwords were not included, that it reported to the Personal Information Protection Commission (PPC) on October 9, and that its Sansan, Bill One, Contract One and Eight services were not affected.
- Suzuki ("Suzuki Village"): about 3,000 members. Data that may have been accessed includes email, nickname, join date, gender, age group, prefecture and car model.
- Yamaha (network engineers' community / Yamaha Corporation): about 1,600 members.
- Yamaha Motor ("YAMAHA PAS Life"): about 1,600 members. Notice dated October 12: name, date of birth, gender, address, email, member ID, nickname, self-introduction and groups may have been viewed. Card and payment data were not included. Separate from Yamaha Corporation's network-engineer community.
- Koikeya: up to 1,800 members.
- Morinaga Milk ("Mount Cafe-bu"): 291 members, with email, username, self-introduction, profile fields, groups, points and last active date.
- Aomori Prefecture ("Aomori Biiki"): 2,950 members out of 15,847, with data such as email, nickname, age group, gender, prefecture of residence and travel-related answers.
- Bandai Namco Experience ("Wangan Midnight" arcade portal): number not disclosed.
Some communities also paused as a precaution and later said they had no leak, such as DyDo's.
The real risk for members
None of the sources mention card data. The most immediate danger is different: well-targeted phishing. Anyone holding the email list of a Suzuki community, for example, also knows each person's car model, age group and prefecture. That makes very convincing fake messages in the brand's name possible.
That is why Suzuki and Morinaga ask members to be wary of emails and text messages using the company's name, not to open suspicious links or attachments, and not to enter passwords or personal details. Suzuki also recommends changing the password on any other service that uses the same (or a similar) password as the community.
What your business can learn from this
This case repeats a lesson we already saw in the Big Echo leak: outsourcing the system does not outsource the responsibility. Whoever collects the data still answers to their customers, even when the vendor is at fault. Some practical steps:
- Inventory the cloud services that hold customer data. Forums, CRM, forms, email marketing tools, chat. Many SMEs don't know how many vendors hold customer lists.
- Review how invitations work. If your service uses invitation links to private areas, prefer links that expire quickly, are single-use or require manual approval. A link that circulates forever is an open door.
- Protect administrator accounts. Require two-factor authentication, limit how many people are administrators and review admin access logs regularly.
- Collect only what you need. If the community doesn't need age group or car model, don't ask. Data you don't store can't leak.
- Put incident notification in the contract. Require fast notification from the vendor. Under Japan's data protection law (APPI), reporting to the PPC is mandatory for leaks involving more than 1,000 people or suspected wrongful intent, such as unauthorized access. It happens in two stages: a preliminary report "promptly" (generally within 3 to 5 days, according to the PPC) and a final report within 30 days, or 60 days when wrongful intent is suspected.
- Keep a notice template ready. The companies that published clear notices on the same day (what happened, what data, what the customer should do, a contact channel) inspired more trust.
- Warn your customers about phishing before it arrives. A simple message saying the company never asks for passwords by email goes a long way against scams.
Conclusion
The attack on Commune lasted only a few days, but it showed how a single flaw in a shared platform can expose the customers of several brands at once. The investigation is still ongoing and the figures may change. We will update this article if Commune or the affected customers disclose new facts.
For your business, the practical question is this: if your cloud vendor were breached tomorrow, would you know what data is there, whom to notify and what to tell your customers?
Sources
- コミューン株式会社: 「Commune」「Commune for Work」への不正アクセスによる個人情報の漏えいに関するお詫びとお知らせ
- INTERNET Watch: コミュニティサービス「Commune」「Commune for Work」に不正アクセス、推計約30万人の個人情報が漏えい
- Sansan: オンラインコミュニティー「Sansan User Forum」における会員情報漏えいに関するお詫びとお知らせ
- スズキ: 当社コミュニティサイト「スズキヴィレッジ」への不正アクセスに関するお知らせ (PDF)
- 森永乳業: 委託先システムへの不正アクセスによる「マウントカフェ部」会員情報漏洩に関するお詫びとお知らせ
- 青森県: 「青森びいき」会員情報の漏洩について (PDF)
- ヤマハ発動機: 外部委託先への不正アクセスによるお客様情報漏えいの可能性について（YAMAHA PAS Life）
- 個人情報保護委員会 (PPC): 漏えい等の対応とお役立ち資料
Want this for your business?
KGA IT helps small and medium-sized businesses set up AI assistants, automation and websites. The consultation is free and we reply within 24 hours. Plans start at ¥5,000/month.
- Phone: 080-9732-1062
- Email: kga-it@outlook.com
- Contact page: kga-it.com/en/contact