Part 10 of a series on Japan’s cybersecurity blind spot. Start with the overview, Japan cyberattacks in 2026: what the breach wave reveals, or read the previous part, Studio.Design breach: your website builder held your keys.

If you joined a brand’s online fan club in Japan in the last few years, there’s a fair chance you never heard of the company that actually ran it.

Commune (コミューン株式会社) sells a platform called commmune that companies use to run customer communities: user forums, fan sites, loyalty clubs, member portals. The brand puts its name on the front. Commune runs everything behind it.

On 9 October, Commune said that from about 18:00 JST on 5 October, an outside attacker had got into “Commune” and “Commune for Work” and that member data had leaked from some communities. Its estimate is about 307,000 people.

Then the brands started posting their own notices. Suzuki. Mazda. Panasonic. Yamaha. Yamaha Motor. LINE Yahoo. Sansan. Calbee. LIXIL. Morinaga Milk. MIXI. Hakuhodo DY ONE. Aomori Prefecture. By 19 October, I count 29 organizations that have said their members’ data was exposed, or may have been, through this one vendor. Another ten had to shut their communities down without, so far, finding a leak.

None of them was breached directly. They all used the same platform.

What Commune says happened

Commune’s 9 October notice is the main source, and it’s worth reading in full. In short:

  • When. Member data leaked between about 18:00 on 5 October and about 21:00 on 6 October, and again between 13:17 and 14:36 on 7 October, all JST. Commune detected the intrusion on 6 October and put every community into maintenance mode from about 21:00 that night. On 7 October the attacker got back in through a route that was still open during maintenance, which Commune closed at 14:58.
  • How. Commune says the attacker exploited flaws in its own system. They obtained invite links to private communities and registered as ordinary members, then impersonated community administrators to view and pull member data and overwrite some of it. Commune says its customers’ settings and operations were not the cause.
  • How many. About 307,000 members, as an estimate. About 126,000 of them had records that included an email address, and about 42,000 of those were Commune’s own employees and test accounts. About 181,000 had other data exposed, such as display names, bios, and private group memberships, without an email address.
  • What wasn’t taken. Commune says it found no leak of passwords or of direct messages between members, and that it doesn’t hold card data. It also says 144 members had their passwords changed to temporary ones without their action. The temporary passwords have expired, and Commune says there’s no sign the attacker received them.
  • What it did. It fixed the flaws, renewed its login signing key, blocked the attack routes and IP addresses, removed accounts and posts the attacker had created, and rolled data back to 18:00 on 6 October. Direct messages, likes, and new sign-ups after that point aren’t expected to come back.

Some of the customer notices go further than Commune does. Chitose Group, which runs a community called Chitose Academy, says Commune’s investigation found the attacker had obtained the login signing key shared by every community Commune runs and used it to impersonate administrators. That route could reach any community, public or private. Chitose adds that the attack came from multiple IP addresses running many operations at once in a short time, and that it was presumably automated “using AI or similar.” Commune’s own notice doesn’t go that far. It does list “renewing the login signing key” as one of its fixes.

Nobody has named an attacker or claimed the attack, as far as I can find.

One key, every tenant

This is the part that matters for anyone who isn’t a Commune customer.

Multi-tenant SaaS is supposed to keep each customer in its own box. Suzuki’s members shouldn’t be reachable from LINE Yahoo’s community, and neither should be reachable from the internet without the right login. If Chitose’s account is accurate, one signing key sat above all of those boxes. Whoever held it could act as the administrator of any of them.

Look at how the individual notices describe it. Softbrain, WingArc1st, JMAM, Unirita, and Tipness all say their community’s administrator account was misused. Shibuya Mirai Design says the attacker used admin rights to go through the member list screen. VALX puts the access to its community at about an hour, from 19:18 to 20:17 on 6 October. Yamaha says its community was accessed from 11:59 to 20:36 that day. Yamaha Motor says 19:18 to 21:02. Community after community, the attacker came in through the front door as the person in charge.

Every customer that has said anything about the cause repeats Commune’s line that its own settings were not to blame. I believe that. It’s also exactly the problem. There was nothing those companies could have configured differently. Their exposure was decided entirely by a vendor’s internal design.

Who was affected

These are the organizations that have said their members’ data was exposed, or may have been, through Commune. The figures are each organization’s own, as published. They mix “confirmed,” “possible,” and “maximum,” and they don’t add up to Commune’s estimate, so read them as reported, not as a running total. All dates are 2026, JST.

Organization Community Disclosed What was exposed (as stated) Count Source
Aomori Prefecture Aomori Biiki (tourism fan community) 8 Oct (leak confirmed 9 Oct) Email, nickname, account name, prefecture, age band, gender, member ID, bio, travel survey answers, points 2,950 of 15,847 members Aomori Prefecture
VALX VALX “FUN” community 8 Oct Email, nickname, account name, profile, points, last use 2,950 of 3,813 (possible) VALX
WingArc1st nest Portal 8 Oct Company, job title, name, kana, email, address and other registered details About 1,200 (estimate) WingArc1st
Yamaha Yamaha Network Engineers (YNE) 9 Oct Email, display name, account name, bio, icon, groups About 1,600 (leaked) Yamaha
Suzuki Suzuki Village 9 Oct Email, nickname, join date, gender, age band, prefecture, car owned About 3,000 (possible) Suzuki
Koikeya Koikeya GOGO! Land 9 Oct Email, nickname, account name, bio, points, groups (including private), last active, sign-up date Up to 1,800 Koikeya
Morinaga Milk Mount Cafe Club 9 Oct Email, display and user name, bio, custom profile, groups, points, last active 291 (possible) Morinaga Milk
Bandai Namco Experience Wangan Midnight Arcade Portal 9 Oct (updated 14 Oct) Email, nickname, account name, bio, profile, groups, points, last active 1,694 (possible) Bandai Namco Experience
Calbee Zeppin-bu (Kappa Ebisen fan site) 9 Oct Email, display name, user name, bio, profile, groups Not disclosed Calbee
LIXIL Sumai Hiroba, Nekokabe Hiroba 9 Oct Nickname, account name, email, profile (including cats’ names and breeds on Nekokabe Hiroba), points, last use Not disclosed LIXIL
LINE Yahoo DS.LAB (in DS.INSIGHT) 9 Oct Nickname, account name, full name, bio, icon, groups, email, profile, points 1,750 (possible) LINE Yahoo
Sansan Sansan User Forum 9 Oct Email, display name, bio, profile image, groups 1,325 confirmed, plus 8,687 possible (without email) Sansan
ZENB JAPAN (Mizkan group) ZENB GARDEN 9 Oct Email, gender, nickname, account name, bio 897 confirmed, up to 949 ZENB JAPAN
Chitose Group Chitose Academy 9 Oct (updated 13 Oct) Name, kana, gender, email, profile (including X account and quiz results), activity Up to 843 Chitose Group
Doppuri Kochi Tabi campaign committee Kochi no Chi (Kochi tourism fan site) 9 Oct (updated 11 Oct) Email, nickname, account name, age, gender, bio, groups, points All 358 members Doppuri Kochi Tabi
JMAM (Japan Management Association Management Center) Toki Lab 9 Oct Display and user name, email, profile including name, address, age, phone 2,950 (leaked) JMAM
Unifa Lookmee Room 9 Oct User ID, display name, email, plus optional organization, nursery name, facility phone 1,450 (possible) Unifa
Softbrain eSales Manager Remix CLOUD user community 9 Oct Company, name, account name, kana, email, profile 1,164 (possible) Softbrain
Panasonic LUMIX Community; Hair-sap by Panasonic Beauty 9 Oct Member data including email About 2,000 + about 3,000 Panasonic
Tipness Positip 9 Oct Email, Tipness member number, user ID, stated purpose and other self-entered details About 3,000 Yahoo! News expert article quoting the notice
Progrit ONE GRITTERS 9 Oct User ID, nickname, account name, email, activity, profile About 2,300, including former members Progrit
Base Food BASE FOOD Labo 9 Oct Email, nickname, account name, profile answers, groups, points About 1,500 (estimate) Base Food
Shibuya Mirai Design Shibuya Mirai Design COMMUNITY 11 Oct Email, nickname, account name and similar 495 (possible) Shibuya Mirai Design
Yamaha Motor YAMAHA PAS Life 12 Oct Name, date of birth, gender, address, email, member ID, nickname, bio, groups About 1,600 (possible) Yamaha Motor
Unirita Oshigoto Kaikaku Lab 13 Oct Email, nickname, account name, bio, profile, groups, points, last active Up to 1,169 (being confirmed) Unirita
Mazda CLUB MAZDA COMMUNITY 14 Oct Member ID, account name, email, gender, prefecture, purchase and usage history, hobbies, survey answers Up to 4,103, including Mazda staff Mazda
MIXI Koto Portal (Kotodaman) 14 Oct Email, member ID, icon, nickname, bio, profile, points, groups 750 (possible; 749 with email) MIXI
Hakuhodo DY ONE DIGIFUL BASE (freelancer community) 14 Oct Email, nickname, account name, bio, profile, groups, points, last active About 1,940 (estimate) Hakuhodo DY ONE
Ajinomoto Aji no Moto-ku (AJINOMOTO PARK fan community) Not dated Not stated; possibly affected customers to be contacted individually Not disclosed AJINOMOTO PARK top page

Several more organizations shut their Commune communities down but say no leak has been found, or have announced only a suspension: DyDo DRINCO, Studist, Tokyu Land and Life & Work Design’s Business Airport, freee, Miki Shoko’s Miki House Park, T&S’s PETiCO community, the Shizuoka industry platform, Dr.BEAUTOPIA’s Lov me Lab, Casio Human Systems, and, according to Security Taisaku Lab, the City of Nagoya’s student platform. No leak is not the same as no impact. Each of them lost a customer channel for a week or more.

The organization-level figures above that include a number add up to somewhere around 48,000 to 57,000 people, depending on whether you take each company’s confirmed or maximum figure. That’s under a fifth of Commune’s 307,000. Commune hasn’t published a client list. It says it’s telling affected customers their own numbers privately. So most of the people in that estimate belong to communities that haven’t said anything in public yet, or have said something I haven’t found.

Timeline

All times JST, from Commune’s notices unless marked.

Date What happened
5 Oct, about 18:00 Unauthorized access to Commune and Commune for Work begins
6 Oct Commune detects it and starts blocking. Customers including Sansan, Softbrain, WingArc1st, LINE Yahoo, Yamaha and Aomori Prefecture are told the same day
6 Oct, about 21:00 All communities switched to maintenance mode
7 Oct, 13:17 to 14:36 Second leak window, through a route left open during maintenance. Closed at 14:58
7 Oct Many customers, including Suzuki, Mazda, Yamaha Motor, Unirita and Chitose, receive Commune’s initial investigation report
8 Oct, about 12:00 Communities that asked to reopen start coming back
8 Oct Commune posts a notice about Aomori Prefecture’s community, which it runs under contract. Aomori, VALX and WingArc1st publish notices
9 Oct Commune publishes its main notice. At least 18 customers publish the same day, according to piyolog
10 Oct, 00:50 Commune takes every community offline again
13 Oct Commune explains the second shutdown: no new intrusion found, but it wants to stop misuse of the leaked email addresses, such as automated posting or password-reset attempts
14 Oct Mazda, MIXI and Hakuhodo DY ONE publish
16 Oct Commune starts reopening communities that ask for it, web browser only, with features restricted. Admin accounts now require two-factor authentication, rate limits are tighter, sessions last 30 days at most, and direct messages and some other features are paused
19 Oct Casio Human Systems says it will keep its member site offline until it’s more confident about safety

Commune says it’s reporting to the Ministry of Internal Affairs and Communications as a telecommunications carrier, and giving customers what they need for their own reports to the Personal Information Protection Commission. Sansan, Softbrain, WingArc1st, Unirita, VALX, Base Food and Koikeya say they have reported to the PPC, and Mazda and Progrit say they are doing so. Koikeya says it has also consulted its local police.

The second shutdown

The 10 October shutdown is the part I’d watch.

Commune says it has found no new unauthorized access or leak since 9 October. It describes the second shutdown as precautionary, to keep leaked email addresses from being used against members.

Two customers describe it differently. Dr.BEAUTOPIA told its members that Commune had seen external attacks continuing intermittently after the restart, but no new damage. T&S told its members that Commune had reported ongoing cyberattacks against its servers. These aren’t necessarily contradictions. Continued attempts and no new success can both be true. But they’re a reminder that what a vendor tells the public and what it tells customers can differ, and customers sometimes say more.

What this means if you don’t use Commune

You might not use Commune. You almost certainly use something like it.

A community is a customer database. Nobody thinks of a fan forum as data collection, but look at the table. LIXIL’s cat community stored members’ cats’ names and breeds. Mazda’s stored purchase history and survey answers. JMAM’s profile fields held names, addresses and phone numbers. Yamaha Motor’s held dates of birth and home addresses. Whatever a company asks members to fill in at sign-up ends up sitting on the vendor’s servers.

The breach comes with your logo on it. Members signed up for Suzuki Village or the LUMIX Community, not for Commune. When a phishing email arrives that knows their nickname, their community and their private groups, it’ll look like it came from the brand. The vendor’s name is in paragraph two of the notice. The brand’s is in the headline.

“Not our settings” isn’t a defense. It’s the most common line in these notices, and the most telling. Under Article 25 of Japan’s personal information law, a company that hands personal data to a contractor has to supervise that contractor. I wrote about this in Part 5: outsourcing the work doesn’t outsource the responsibility. Yamaha said it would review how it manages contractors. Sansan said it would strengthen its oversight. That’s the right instinct, and it’s the job before the breach, not after.

Concentration is the risk. I keep coming back to this in this series. i-ask held five companies’ customer enquiries. IDCF Cloud carried 495 customers. Studio held stored keys and form data for its whole customer base. Commune held the members of dozens of brands’ communities behind one login key, if Chitose’s account is right. Each looked like a sensible, established choice. Each turned one flaw into many breaches. The pattern across vendors is on the Japan supply chain cyberattacks map, and the incident-by-incident list is the Japan breach tracker.

Questions to ask your SaaS vendors

You don’t need to audit a vendor’s code to learn a lot. You need to ask direct questions and notice which ones get vague answers.

  1. Is our data isolated from other customers’, and how? Separate databases, separate encryption keys, or just a tenant ID column? Is there any credential or signing key that works across all customers?
  2. Who can act as an administrator of our account? Including the vendor’s own staff and support tools. Is two-factor authentication required for all of them? Commune made it mandatory for administrator accounts as one of its fixes before reopening.
  3. Is there rate limiting on exports, member lists and APIs? Chitose describes many operations at once from multiple IP addresses. Limits on bulk access are what turn a breach of everything into a breach of a little.
  4. What do you log, and can we see it? Can you tell us, per community and per minute, what was accessed, the way VALX and Yamaha could?
  5. How fast will you tell us, and what will you tell us? Here, most customers that gave a date say they heard on 6 or 7 October, two or three days before Commune’s public notice. Put that timing in the contract.
  6. Can we export everything, and delete what we don’t need? Including former members. Progrit’s count includes people who had already left.
  7. What happens to our service if you shut down for a week? Because that’s what happened here, twice.

And one question for yourself: what are we asking members to give us that we don’t need? Every optional profile field in that table was somebody’s decision.

If you want help with this

Most companies I talk to can’t list every outside service that holds their customers’ data, let alone answer those seven questions about each one. That list is where a Diagnostics review starts: which vendors hold what, under whose account, and what to fix first. If you’d rather begin with what’s visible from outside, my external exposure check reviews up to three of your domains using only public information, with a written report within five business days.

The next part, Everyone can see it. Only attackers act on it., looks at why the people who notice a company’s public weaknesses stay quiet.

Sources