Commune: Platform Flaw Lets Attacker Impersonate Admins and Leak 307,000 Members' Data

Tokyo-based Commune Inc. disclosed on 9 October 2026 that an outside party exploited a flaw in its "Commune" and "Commune for Work" community platforms. The attacker impersonated community administrators and took member data on an estimated 307,000 people. Every account available to us uses the same 307,000 figure. Commune says the number is a log-based estimate that may change. Several enterprise customers have since published their own notices, including Sansan, Calbee, BASE FOOD, WingArc1st, VALX, CHITOSE Group and Aomori Prefecture. TSN reports that Panasonic's forum was also affected, but none of the other sources we reviewed confirm this. Commune says it has found no misuse or secondary damage so far.

What Happened

Commune's notice, as reported by TSN, Security Measures Lab and Act, describes two leak windows in Japan time:

• Window 1: about 18:00 on 5 October to about 21:00 on 6 October. Commune detected the intrusion on 6 October and moved all communities into maintenance mode at about 21:00 that night.
• Window 2: 13:17 to 14:36 on 7 October. Commune says the attacker used a communication path that was still open during maintenance to register accounts and view data. It blocked that path at 14:58.

Communities whose operators asked to come back online began reopening in phases from about 12:00 on 8 October. CHITOSE Group says Commune restored each community to its state at 18:00 on 6 October, and members of reopened communities must log in again. Calbee's and BASE FOOD's communities were still offline when they published their notices.

Commune says two other products, Commune CRM and Commune Engage, saw access attempts but no data leak. It says Commune Voice, Navigator and DataHub were not accessed. Commune plans to report the incident to Japan's Ministry of Internal Affairs and Communications because it is a telecom operator, and it is giving customers the details they need to file with the Personal Information Protection Commission. Sansan and BASE FOOD say they have already filed.

Some outlets go further than this. AliasFleet's blog, citing Asahi Shimbun, says communities run for Suzuki, ZENB JAPAN and LINE Yahoo were also affected. None of the other sources we reviewed confirm this.

What Was Taken

Commune's breakdown, as reported by several secondary sources:

• About 126,000 people: records that include email addresses. About 42,000 of these are Commune staff and test demo accounts, which leaves roughly 84,000 real external members (TSN's arithmetic).
• About 181,000 people: records without email addresses, covering display names, self-introductions and private-group membership.
• 144 members: their passwords were changed to temporary ones without their action. Commune says those temporary passwords have expired and it found no sign they reached the attacker.

Commune says passwords, direct messages and card payment data were not leaked. CHITOSE Group says it has confirmed that login passwords were not viewed or taken.

What was exposed varies by community, depending on which profile fields each operator collected. Customer disclosures so far:

VALX and Aomori report the same figure of 2,950. That may be a coincidence or a reporting error, and we could not confirm which. WingArc1st's list includes physical addresses, which is more sensitive than most of what was exposed elsewhere.

The Attack Technique

The sources agree on the result but describe the method differently.

• Commune's account (via secondary reports): the attacker exploited a flaw in Commune's system. They improperly obtained invite links to private communities, registered as ordinary members, and then impersonated administrators to view and overwrite member data. Commune says customer settings were not the cause.
• CHITOSE Group's account (citing Commune's investigation): the attacker obtained the login signing key shared across every Commune-managed community and used it to impersonate administrators. CHITOSE says this path could reach any community, public or private. It also says the attack ran many operations at once from multiple IP addresses in a short time, and on that basis estimates the attack was automated, possibly using AI.

The two accounts may describe different stages of one attack chain. Commune's own reported fixes include rotating the login signing key, which is consistent with CHITOSE's version. However, Commune has not publicly confirmed that the key was stolen or explained how the attacker got it. The suggestion of AI automation is CHITOSE's inference and has not been confirmed. No threat actor has been named, and no source reports the data being sold or posted.

Why It Matters

• One vendor, many breaches. A single failure in a multi-tenant system exposed member data for dozens of brands and at least one prefectural government. Most affected members had never heard of Commune.
• A single shared key is a single point of failure. If CHITOSE's account is right, one signing key protected logins for every tenant. Losing it let the attacker act as an administrator anywhere on the platform.
• The data is well suited to phishing. Email addresses combined with brand affiliation, group membership and profile text are enough for convincing brand-themed phishing. Sansan users also include business customers, so targeted attacks on companies are possible.
• Maintenance mode did not stop the attacker. The second leak on 7 October happened while all communities were supposedly offline, because a communication path was still open.

What Organizations Should Do

1. List your SaaS community and forum vendors. Find out which customer and employee data each one holds, and make breach notification and log access contractual requirements.
2. Ask vendors how authentication keys are separated between tenants. Push for per-tenant signing keys, regular rotation, and storage in an HSM or KMS rather than one platform-wide secret.
3. Treat invite links as credentials. Make them expire, limit how many times they can be used, bind them to specific invitees, and audit who joined through them.
4. Alert on admin activity spikes. Bulk member exports and simultaneous admin sessions from multiple IP addresses should trigger an alert and automatic suspension.
5. Make containment complete. When you take a service down, close every API and registration path, not only the user interface.
6. Warn affected members early. Tell them to expect brand-themed phishing, remind them you will never ask for passwords or card details by email, and collect only the profile fields the community actually needs.

Sources: Commune Breach: About 307,000 Members' Data Leaked in Japan | 【重要】コミュニティサイト「ちとせアカデミー」への不正アクセスによる個人情報流出可能性に関するお知らせとお詫び（速報） - CHITO... | コミューン「Commune」に不正アクセスによるサイバー攻撃で約30.7万人の個人情報漏洩の恐れセキュリティニュースのセキュリティ対策Lab | Communeに不正アクセス 約30.7万人分の会員情報が漏えい - 株式会社アクト | Commune Vendor Breach Hits Suzuki, ZENB JAPAN and More | カルビー／絶品部「やめられない、とまらない」課の事案（流出確認・サービス停止）｜対象情報・対処法・A評価｜セカヤサAIブログ | 委託先システムへの不正アクセスに伴う、会員コミュニティ「BASE FOOD Labo」における個人情報漏えいの可能性に関するお詫びとご... | オンラインコミュニティー「Sansan User Forum」における会員情報漏えいに関するお詫びとお知らせ Sansan株式会社