Oct 9 and 10 turned the Commune breach into a drip feed of brand notices: Sansan confirmed 1,325 leaked emails, Panasonic reported about 5,000 across two communities, and Bandai Namco Experience confirmed roughly 1,700 arcade portal members. Taken together they are slices of one file of roughly 126,000 email addresses, and it is sitting with the attacker. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. Each notice, read on its own, looks like a minor incident.
A vendor breach always produces two pictures of the same damage. Never the same picture twice. The brands see their slices, each with its own apology letter and its own filing: a few thousand here, a few hundred there. The attacker sees the whole plate. Commune estimated about 307,000 affected member records on Oct 9, roughly 126,000 of which carried email addresses (yesterday's piece covered that disclosure in full), which means every slice below was already inside that count, so the numbers are not rising. Only the shape is coming into focus.
The new disclosures
Panasonic came out with two communities at once: about 2,000 members of the LUMIX Community and about 3,000 of ヘアサプ by Panasonic Beauty, email addresses included, all of it per Commune's own report to the company. Panasonic is warning users about mail impersonating the company or its affiliates. The ITmedia roundup notes that both figures came from Panasonic's own announcement.
Sansan's official notice is the most precise of the batch. 1,325 confirmed leaks from the Sansan User Forum: email addresses, account (display) names, self-introduction text, profile images, group memberships. Another 8,687 accounts may have leaked something too, though without email addresses attached; passwords were not in the file at all. Sansan has filed with the Personal Information Protection Commission, notified the affected users individually on Oct 9, and stresses that its core services (Sansan, Bill One, Contract One, Eight) were never touched. Nikkei's reporting matches the figures.
Bandai Namco Experience disclosed on Oct 9 that its 湾岸ミッドナイト アーケードポータル, built on Commune, was breached across Oct 5-6. Roughly 1,700 members. Game*Spark's itemised list from the company's announcement: email addresses, nicknames, account names, self-intros, profile items, group memberships, points, last-active times. Nikkei's reporting includes passwords among the leaked fields and says the company wants password changes on other services too. The two versions disagree on passwords, so that part stays unresolved, and with no confirmed misuse so far, the portal remains in maintenance.
The smallest disclosure says the most about how thorough the sweep was. Kochi Prefecture's official tourism fan site 高知の知: all 358 members, according to テレビ高知 and RKC. Email addresses, nicknames, age and gender sit among 11 leaked items; names and addresses are not confirmed as leaked. Commune flagged the intrusion on Oct 6, Kochi confirmed the leak on Oct 7, and the apology mail went out on Oct 9.
LIXIL disclosed on Oct 9 that its housing-related community was caught up in the breach, per CNET Japan, but so far no source has published data types or member counts. Calbee, which had no disclosure of its own yesterday, has since published one for its 絶品部「やめられない、とまらない」課 community (via piyolog's Oct-10 roundup), also without itemised figures. Worth watching, not worth counting.
How one key turned into one file
The follow-on reporting added the sharpest detail of the week. The ちとせ group, which disclosed its own ちとせアカデミー community on Oct 9, says Commune's investigation found the attacker had obtained the login signing key shared across every managed community, and that bulk operations from many IP addresses in a short window point to an AI-automated attack. That is the group's reading of the investigation findings rather than Commune's stated conclusion, but the mechanics fit: nobody probes patiently with a stolen signing key in hand. It was a bulk pull.
All of it came out of one platform in two windows: Oct 5 18:00 to Oct 6 21:00, and Oct 7 13:17 to roughly 14:36 in piyolog's roundup (INTERNET Watch put the cut at 14:58). The method is the one Commune described on Oct 9: stolen invite links into closed communities, registration as ordinary members, then admin impersonation to read, copy and overwrite member data.
Stack the itemised email slices: 1,325 from Sansan, about 5,000 from Panasonic's two communities, about 1,700 from Bandai Namco Experience, 358 from Kochi. Roughly 8,400 email addresses newly assigned to brands, which is where the two pictures of the damage split apart. Sansan's victims receive a notice about 1,325 people. Panasonic's see about 5,000 spread across a camera community and a hair-care one. Kochi's see 358. The attacker holds one file of roughly 126,000 email addresses joined to nicknames, self-intros and community memberships, and it knows exactly which person belongs to which brand. That asymmetry is what the next wave of mail will work with.
The alias that names its source
There is exactly one field in that file you could have made traceable, and it is the email address. The mechanism is an email alias dedicated to each community, forwarding to your real inbox.
Why it ends the confusion: the follow-on disclosures keep arriving brand by brand, and the phishing will follow the same shape. Camera people get a "LUMIX Community notice"; business users get a "Sansan User Forum" warning. But suppose a password-reset message for a hair-care brand you have never heard of lands on your LUMIX alias. The alias has just named the forgery. Panasonic never held that address in the form the sender claims. That is the leak-tracing mechanism working the way this breach is structured, one slice at a time. Kill the alias and the impersonation channel for that brand dies while your real inbox stays clean. The set-up guide takes about two minutes.
The limit, stated plainly: an alias cannot unwrite your self-intro or change the nickname you reused across three communities. That travels with the file no matter what address you used. It protects the channel, not the biography.
What to do if you were in one of these communities
If you signed up for any of these communities with your main address, the notice stings; the fix is deliberately boring, and boring works here.
- Do not click links in any message about this breach. Open the company's own site or app yourself, typed by hand. The forged versions will quote the real notices word for word.
- Change the password anywhere you reused your community password. The Bandai Namco Experience password question is unresolved, and credential stuffing pairs leaked emails with passwords from older breaches anyway.
- Expect impersonation that knows your profile. Nicknames, self-intros, group memberships, points, last-active times: all in the file. A message that greets you by your community nickname is proving it has the data, not that it is legitimate.
- Give calls and texts that "confirm your identity" by reading your details back to you the same suspicion.
- Check Have I Been Pwned once the incident is listed, and turn on its breach notifications.
- Walk the breach-response order of operations. It is written for exactly this.
What still needs answers
Three questions are still open: whether more brands come forward with their slices, and whether any of them revises the figures Commune already published; whether the stolen dataset surfaces anywhere public, which would turn a contained intrusion into a circulating one; and whether the forged-admin wave actually arrives, and which brand's notice it wears first. The disclosers are still counting slices. The attacker counted the whole file on day one.
Top comments (0)