Security Guides
Unauthorized Access to Commune (About 307,000 People, Estimated): Member Data from Corporate Communities Leaked — What Members and Operators Should Do
On October 9, 2026, Commune Inc. said member data of about 307,000 people (estimate) leaked from its Commune and Commune for Work community services. How to check if you are affected, client notices, and what to do today.
For: anyone registered with a corporate fan site, user group or local-government fan community, and companies and organizations that run communities on services like Commune. This article is based on the official notices of Commune Inc. and of client companies and organizations that disclosed impact, and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 12, 2026Not yet known
- Number of people and items per community (being sent to clients individually)
- Number of client companies affected
- Details of the system flaws
- When all communities will reopen
- When posts and other data will be restored
Commune Inc. says it will publish any new facts that should be announced on the same notice page. As of October 12, there was no follow-up or revision to the October 9 notice.
What members should do today
Check the notice of the company that runs your community
Commune is a service that companies and local governments use to build their own fan sites and user groups. Members do not register with Commune Inc. itself but with the operator's community (for example Suzuki Village or Koikeya GOGO! Land). So whether you are affected depends on which community you joined.
Open the notice for your community in the table "Check whether you are affected" below. If your community is not listed, check the news section of the operator's official website. Commune Inc. says it will contact affected members as soon as details are confirmed.
Do not open links in emails or texts claiming to be the community or the company
The leaked data includes email addresses, display names, profiles and group memberships. With that combination, someone can write an email that appears to come from the community's organizers, with your correct name and the right topics.
Commune Inc. asks people not to open URLs or attachments in suspicious emails or text messages and to delete them, and says it will never ask for passwords by email or phone. Open reopening notices and log in through a bookmark or the operator's official website rather than through email links (see What is phishing?).
The 144 members whose passwords were changed should reset them after reopening
According to Commune Inc., 144 members had their passwords changed to temporary ones without their action. The temporary passwords have already expired, and the company says it found no sign that they reached the attacker.
Those members need to set a new password after their community reopens, using "Forgot your password" on the login screen. For safety, all members have been logged out, so everyone else also needs to log in again after reopening.
If you use the same password elsewhere, make them different
Commune Inc. says no leak of the passwords themselves was confirmed. Even so, Suzuki and Bandai Namco Experience advise people who use the same password on other services to consider changing it as a precaution. Not reusing passwords keeps a leak in one place from spreading (a password manager makes this practical).
If you wrote your address or phone number in your profile, also watch for calls and letters
The items differ by community and by member. JMAM said that on its Toki Labo community, profile information including names, addresses, ages and phone numbers also leaked.
If you wrote your address or phone number in your profile, expect that text messages, calls or letters claiming to be the company or the community are also possible, not just emails. If a caller asks for a password, card number or verification code, do not answer; hang up and call back on the number listed on the official website.
For questions, use the contacts listed in the notice
In Commune Inc.'s notice, members can send questions or withdrawal requests through its form (communeinc.com/ja/contact-user), and questions about the unauthorized access go to security@commune.co.jp. Reopening dates are announced in each operator's notices.
Check whether you are affected (notices from client companies and organizations)
The companies and organizations that run communities have each published notices. The table lists those this site opened and checked on their official pages (as of October 12, 2026). Other companies and organizations have also published notices.
The numbers are as each operator stated them, and each counts differently ("leaked", "may have been viewed or taken", "up to"), so they cannot be added together.
| Operator | Community | People (as stated) | Main items (as stated) | Status | Date |
|---|---|---|---|---|---|
| Yamaha | Yamaha Network Engineer Association (YNE) | About 1,600 | Email, display name, account name, profile text, icon, groups | Leak confirmed (company) | Oct 9 |
| JMAM (Japan Management Association Management Center) | Toki Labo | 2,950 (registered after the May 12 relaunch) | Display name, user name, email, profile information (including name, address, age and phone number) | Leak confirmed (company) | Oct 9 |
| Aomori Prefecture | Aomori Biiki | Up to 2,950 (estimated maximum viewed, of 15,847 members) | Email, nickname, account name, prefecture of residence, age group, gender, member ID, profile text and more | Possible (prefecture) | Oct 8 |
| Suzuki | Suzuki Village | About 3,000 | Email, nickname, join date, gender, age group, prefecture, car owned | Possible (company) | Oct 9 |
| Sansan | Sansan User Forum | 1,325 confirmed, 8,687 possible | Confirmed: email, display name, profile text, profile picture, groups (the possible group excludes email) | Leak confirmed / possible (company) | Oct 9 |
| LY Corporation | DS.LAB (in DS.INSIGHT) | 1,750 | Nickname, account name, name, profile text, icon, groups, email, custom profile fields and more | Possible (company) | Oct 9 |
| Koikeya | Koikeya GOGO! Land | Up to 1,800 records | Email, nickname, account name, profile text, groups, custom profile fields (gender, age group, prefecture and more) and more | Leak confirmed (company) | Oct 9 |
| Calbee | Zeppin-bu fan site | Not stated | Email, display name, user name, profile text, profile fields, groups | Viewed and taken (company) | Oct 9 |
| Morinaga Milk | Mount Cafe-bu | 291 | Email, display and user name, profile text, custom profile fields, groups and more | Possible (company) | Oct 9 |
| LIXIL | Sumai Hiroba / Nyanpeki Hiroba | Not stated | Nickname, account name, email, profile text (fields differ by service), points and more | Possible (company) | Oct 9 |
| Bandai Namco Experience | Wangan Midnight Arcade Portal | Not stated | Email, nickname, account name, profile text, profile fields, groups and more | Possible (company) | Oct 9 |
| DyDo DRINCO | dydo Issho ni Lab | — | Told that no damage was found and no member data leaked (service suspended) | Not included (company) | Oct 9 |
Even within one community, it depends on what you registered
Calbee and Koikeya say they do not collect or hold addresses or phone numbers in their communities. On the other hand, JMAM reported that names, addresses and phone numbers leaked as part of profile content. If the "main items" for your community include a free-text profile, remember what you wrote there.
What happened (according to Commune Inc.)
The following is based on Commune Inc.'s notice of October 9, 2026. Times are Japan time.
October 5, 2026, about 18:00
Commune and Commune for Work begin to be accessed without authorization by an outside third party.October 6
The company detects the access and cuts off communication and applies defensive measures. From about 21:00, all communities are switched to maintenance mode and halted.October 7
Unauthorized member registration and viewing occur in some places through a communication path left open during maintenance; it is cut off at 14:58.October 8, about 12:00
After confirming safety on internal test communities, communities that asked to reopen start reopening in stages.October 8
The company first publishes a notice about "Aomori Biiki", the Aomori tourism fan community it runs for Aomori Prefecture.October 9
The company publishes an apology and notice about the leak. Client companies and organizations publish their own notices between the previous day and this day.As of October 12
No follow-up yet. Communities still in maintenance will reopen in stages after confirmation with each client, the company says.
- Leak periods
- About 18:00 on October 5 to about 21:00 on October 6, and 13:17 to 14:36 on October 7
- Data including email addresses
- About 126,000 people (including about 42,000 of the company's own employee and test/demo accounts)
- Data without email addresses
- About 181,000 people (display names, profiles, private group memberships and so on)
- How people were counted
- Estimated unique people, excluding duplicate member IDs and accounts created by the attacker. May change as the investigation progresses
- Passwords
- 144 members had passwords changed to temporary ones without their action. No leak of the passwords themselves was confirmed
- Not found
- No leak of direct messages between members or of passwords was confirmed. The company does not hold credit card or other payment data
- Other products
- Commune CRM and Commune Engage: access was attempted but no leak occurred. Commune Voice, Navigator and DataHub: not accessed, according to the investigation so far
- Stated cause
- Flaws in the company's system were exploited. The attacker obtained invitation links to private communities illegitimately and registered as an ordinary member, and impersonated administrators to view and take member data and overwrite data
- Response
- Fixed the flaws, renewed the signing keys used for login, cut off the access path and blocked malicious IP addresses, removed accounts and posts created by the attacker
- Data
- Rolled back to its state at 18:00 on October 6. Restoration of posts is being prepared; direct messages, likes and reactions, and new registrations are expected not to be restored
The company says the incident resulted from an attack on its own system and was not caused by its clients' settings or operations. As a telecommunications carrier it is reporting to the Ministry of Internal Affairs and Communications, and it is providing clients with the information they need to report to the Personal Information Protection Commission.
What we know and what we don't
Status as of October 12, 2026. When a follow-up is published, the status column will be updated.
| Item | What the notice says | Status |
|---|---|---|
| Leak periods | About 18:00 Oct 5 to about 21:00 Oct 6; 13:17 to 14:36 Oct 7 | Leak confirmed (company) |
| Number of people | About 307,000 (estimate; may change as the investigation progresses) | Leak confirmed (company) |
| Email addresses | About 126,000 people (including about 42,000 own employee and demo accounts) | Leak confirmed (company) |
| Display names, profile text, private group memberships | About 181,000 people (without email addresses) | Leak confirmed (company) |
| Names, addresses, phone numbers in profiles | Not stated in Commune Inc.'s notice. JMAM reported a leak on Toki Labo | Leak confirmed (client) |
| Passwords | 144 changed to temporary ones; no leak of the passwords themselves confirmed | Not included (company) |
| Direct messages | No leak confirmed | Not included (company) |
| Credit card and other payment data | Not held by the company | Not included (company) |
| Numbers per community | Being sent individually to affected clients | Under investigation |
| Number of client companies affected | Not stated in the notice | Not stated |
| Cause | Illegitimately obtained invitation links and impersonation of administrators; details of the flaws not stated | Explained (details not stated) |
| Misuse or secondary harm | None confirmed as of October 9 | Under investigation |
| Reopening | In stages from about 12:00 on October 8, for communities that asked to reopen | Reopening |
Client notices may show different times and numbers
The times in Commune Inc.'s notice cover the whole service. For example, Yamaha said that, according to Commune Inc., access to its own community's data took place from about 11:59 to about 20:36 on October 6. Each operator also states the number for its own community, counted in its own way. Check your own situation in the notice for the community you joined.
What the leaked items can be used for
In general, the following combinations make the following misuse possible. This does not mean it has happened in this case.
- Email + display name + community name: a convincing "reopening" or "points awarded" email that appears to come from the community's organizers, addressed to you by name
- Group memberships (including private groups): fake messages tailored to insider topics, such as "To members of the XX group"
- Profile text and fields (age group, prefecture, car owned, favorite products): material to build trust by mentioning things only you should know
- Name + address + phone number (if written in a profile): fake texts, calls or letters claiming to be the company
Another case where one provider's service exposed customer data of several companies that use it is the Daiwa Securities vendor breach published in October 2026 (several companies using the same vendor disclosed impact). There too, the items and numbers differed by client, and people checked whether they were affected through the notice of the company they deal with.
What community operators should review
Commune Inc. attributes the incident to flaws in its own system and says it was not caused by its clients' settings or operations. This section does not judge the clients' handling. It sets out what operators running communities on similar services can check in their own community, based on the published sequence of events and the leaked items.
Always held
Email, display name, groups
If leaked: emails posing as the organizers
Written by members
Profile text, free-text profile fields
If leaked: even the operator does not know what leaked
Asked by the operator
Age group, prefecture, gender, custom fields
Can be reduced: keep only fields you use
Design profiles so members do not write addresses or phone numbers
In this case, Calbee and Koikeya were able to say that addresses and phone numbers are not collected or held in their communities. A free-text profile is different: what members write there is not a defined field, so information the operator never meant to hold can leak.
If your community does not need addresses or phone numbers, say clearly not to write them in the profile examples and instructions, and do not create custom fields for them. Review fields you ask for analysis, such as age group or prefecture, and remove any you do not actually use.
Do not keep using one invitation link as a shared password for a private community
Commune Inc. says invitation links to private communities were obtained illegitimately and used to register as ordinary members. How they were obtained has not been published.
In general, if one invitation link is shared with everyone and kept for a long time, anyone can join once the link gets out. If the service supports it, issue invitations per person, with an expiry date and a usage limit. If you do use a shared link, replace it regularly and combine it with approval (the operator approves each registration), so unknown sign-ups are noticed.
Review administrator accounts and recent registrations
Commune Inc. says member data was viewed and taken by impersonating administrators. Although this came from flaws on the service side, operators who regularly check who holds administrator rights, and how many, are more likely to notice an administrator they do not recognize or a batch of members registered at odd hours. Commune Inc. says it has removed accounts created by the attacker; reviewing your own community's member list once before reopening is still worthwhile.
Decide and announce the genuine channel for contacting members in advance
After a leak, what protects members is knowing which messages from the organizers are genuine. If you decide that notices always appear on a fixed page in the community and on the official website, and that emails never contain links asking members to log in, and announce this in normal times, members can tell a fake email from a real one. In this case too, several client companies stated in their notices that they never ask for passwords by email.
This site's take: you can outsource the platform, but you still decide what to collect
Even when the community platform is provided by an outside service, the operator decides what members are asked to write and which fields are required. Laying the client notices side by side, the items each listed differed according to what each community had collected, even though they all used the same service. Data you never collect cannot leak.
Sources (public record)
The facts in this article are based on the public information below. We have not speculated about unpublished attack techniques. Titles are translated from Japanese.
- Commune Inc., "Apology and notice regarding the leak of personal data due to unauthorized access to our Commune and Commune for Work services" (October 9, 2026) — communeinc.com
- Yamaha Corporation, "Leak of customer information due to unauthorized access to an outsourcing contractor" (October 9, 2026) — yamaha.com
- JMAM, "Apology and notice regarding a personal data leak due to unauthorized access on our user community site Toki Labo" (October 9, 2026) — jmam.co.jp
- Aomori Prefecture, "Unauthorized access confirmed on the official fan community Aomori Biiki" (October 8, 2026) — pref.aomori.lg.jp
- Suzuki Motor Corporation, "Notice of unauthorized access to our community site Suzuki Village" (October 9, 2026) — suzuki.co.jp
- Sansan, Inc., "Apology and notice regarding the leak of member data on the online community Sansan User Forum" (October 9, 2026) — corp-sansan.com
- LY Corporation, "Notice and apology regarding an information leak resulting from unauthorized access to a contractor's system" (October 9, 2026) — lycorp.co.jp
- Koikeya Co., Ltd., "Leak of customer information due to unauthorized access to a contractor" (October 9, 2026) — koikeya.co.jp
- Calbee, Inc., "Notice and apology regarding the impact on member data from unauthorized access on the Zeppin-bu fan site" (October 9, 2026) — calbee.co.jp
- Morinaga Milk Industry Co., Ltd., "Apology and notice regarding the leak of Mount Cafe-bu member data due to unauthorized access to a contractor's system" (October 9, 2026) — morinagamilk.co.jp
- LIXIL Corporation, "Apology and report regarding a personal data leak due to unauthorized access to a contractor's server used by LIXIL's community services" (October 9, 2026) — lixil.co.jp
- Bandai Namco Experience Inc., "Apology regarding a possible member data leak due to unauthorized access to Wangan Midnight Arcade Portal, and continued maintenance" (October 9, 2026) — wanganmaxi-official.com
- DyDo DRINCO, Inc., "Suspension of the fan site dydo Issho ni Lab" (October 9, 2026) — dydo.co.jp
Update history
2026-10-12: First version, based on Commune Inc.'s notice of October 9 and 12 notices from client companies and organizations (on October 12 we confirmed there was no follow-up or revision to Commune Inc.'s notice). Will be updated when per-community numbers or details of the cause are published.
Read next
- A similar case: Daiwa Securities vendor breach
- Fake messages and passwords: What is phishing? / How to check if your password leaked / Choosing MFA the right way
- Other 2026 incidents: Data breaches and cyberattacks of 2026
FAQ
QWhat leaked in the Commune incident?
According to Commune Inc.'s notice of October 9, 2026, about 307,000 members (estimate) were affected. For about 126,000, data including email addresses leaked; for about 181,000, data without email addresses leaked (display names, profiles, private group memberships and so on). The items differ by community and by member, depending on what each person had entered in their profile. JMAM said that on its Toki Labo community, the names, addresses, ages and phone numbers included in profile information also leaked.
QAm I affected?
Commune is a service that companies and local governments use to build their own fan sites and user groups, so whether you are affected depends on which community you joined. First, check the notice of the company or organization that runs your community (the table in this article lists the ones this site confirmed on their official pages). Commune Inc. says it will contact affected members as soon as details are confirmed. Even if you receive an email, check through the official website you open yourself rather than the link in the email.
QShould I change my password?
Commune Inc. says no leak of the passwords themselves was confirmed. However, for 144 members the password was changed to a temporary one without their action. The temporary passwords have already expired, and those members need to set a new password after their community reopens, using 'Forgot your password' on the login screen. All members have been logged out, so everyone needs to log in again after reopening. If you use the same password on other services, it is safer to change it there too, as some client companies such as Suzuki advise.
QWhat caused it?
Commune Inc. says an outside third party exploited flaws in its system. Specifically, the attacker obtained invitation links to private communities illegitimately and registered as an ordinary member, and impersonated administrators to view and take member data and overwrite data. The company says the incident was not caused by its clients' settings or operations. Details of the flaws have not been published.
QWhat if I get an email claiming to be my community or the company that runs it?
Leaked email addresses together with display names and group memberships make it possible to write a convincing email that appears to come from the community's organizers. Commune Inc. asks people not to open URLs or attachments in suspicious emails or text messages and to delete them, and says it will never ask for passwords by email or phone. Check reopening news and log in through a bookmark or the operator's official website.
QI wrote my address or phone number in my profile. What should I watch for?
What leaked depends on what you wrote in your profile. If you included your address or phone number, expect that text messages, calls or letters claiming to be the company or the community are also possible, not just emails. If a caller asks for a password, card number or verification code, do not answer; hang up and call back on the number listed on the official website. After your community reopens, review your profile and remove anything you do not need there.