Yamaha Motor disclosed yesterday that its slice of the Commune breach lists real names, dates of birth and home addresses for about 1,600 members. Each new Commune disclosure is adding fields, not victims. The stolen file is graduating from a contact list into an identity file. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. Two earlier pieces tracked the growing list of disclosers. This one is about what the file now holds, and it is the sharpest change yet.
The richest slice names a home address
Yamaha Motor's notice covers its electric-assist bicycle community, YAMAHA PAS Life. About 1,600 members' data may have been viewed or acquired, per the release on the Digital PR Platform. Nine fields, itemised: real names, dates of birth, gender, addresses, email addresses, member IDs, nicknames, self-introductions, group memberships. Tokyo Shimbun carried the same itemisation through 共同通信 on the same day.
Stop at that list. This is the first Commune slice to put real names and home addresses next to the email addresses. Every earlier disclosure topped out at nicknames or display names: Sansan's 1,325, Bandai Namco's 1,700, Mizkan's ZENB 897, LIXIL's uncounted housing slice. Kochi's 358 members got age and gender with names and addresses explicitly not confirmed. Suzuki's got car names and prefectures. PAS Life breaks the run: nine fields, and the two most sensitive are the ones nobody had named before.
One caution before the conclusion writes itself. What is escalating is the publicly itemised disclosure. Earlier companies may well have held real names and addresses in their slices and simply never itemised them. The careful claim is that Yamaha Motor is the first to NAME identity fields, not necessarily the first to have had them. That said, attackers do not need the confirmation to use the pattern. A file that keeps gaining fields is a file worth mining twice.
The mechanics: intrusion between 19:18 and about 21:02 on Oct 6, per Commune's report to the company. That fits inside Commune's own stated first window, Oct 5 around 18:00 to Oct 6 around 21:00. Yamaha Motor's own systems were not touched; the servers were Commune's. No misuse confirmed, no card or payment data included. The company's language is 可能性 throughout: viewed or acquired, not exfiltrated. Keep the hedge.
The other names on the file this week
A second Yamaha disclosed three days earlier. Yamaha Network Engineers, a separate company, announced on Oct 9 that its ヤマハネットワークエンジニア会 (YNE) community may have lost about 1,600 members' email addresses, display names, account names, self-introductions, icons and group memberships, per the Nikkei-hosted release. Same count, different company, different community, different fields. The window was Oct 6, 11:59 to 20:36. YNE is a genuinely new discloser, never covered in the earlier pieces.
LINEヤフー's DS.LAB slice, summarised in ITmedia's Oct-10 roundup, carries the longest field list of any Commune disclosure so far: nicknames, account names, real names, bios, icons, group memberships, email addresses, custom profile items, points and last-active times. No victim count was published, and inventing one would be easy and wrong. Two fields do the damage here. Real names turn a nickname into an identity. Points are the field attackers have cashed out in other breaches; gift-code theft has a price tag now.
Sansan, meanwhile, drew a line most disclosers skip. Its Oct-9 notice confirms 1,325 Sansan User Forum members whose email addresses leaked, and separately lists 8,687 accounts whose display names, self-introductions, images and group memberships may have leaked with no email address attached. That second tier cannot be phished by email at all. The phishing-relevant population is the 1,325, not the headline total. Sansan also notified those members individually and confirmed its core services were never touched. Other brands itemising tiers this cleanly would make every one of these disclosures easier to read.
When the caller knows your address
Here is where the attack changes shape. A forged notice that greets you by your community nickname is proving it holds the data. A forged notice that opens with your real name, your date of birth and your home address is doing something else entirely: it is passing your verification checks for you.
Think about how identity checks actually work. A call centre asks for your name, your date of birth, your address. Those were security questions because only you were supposed to know them. Yamaha Motor's nine fields hand all three to the attacker in one row. LINEヤフー's custom profile items fill in whatever the other slices left blank. The defence "we need to confirm your identity" stops working when the person on the line already holds every answer.
The first wave of Commune slices gave the attacker context: what you ride, what you cook, where you garden. The new slices give it credentials of identity. Nine fields is enough to open a conversation with a bank, a mobile carrier or a delivery company and sound like the account holder. That is not a hypothetical upgrade. It is the difference between spam and social engineering, and it is why victim advice has to escalate past "do not click links."
The next forged notices about this breach will quote your real name, your address and the community you joined, and ask you to "confirm" something small. Anyone reading your own details back to you is proving they hold the file, not that they are legitimate. Verify through the company's own site, typed by hand.
One more detail from Commune's own notice, via ITmedia's Oct-9 report: 144 members had their passwords changed to temporary ones without doing it themselves. Passwords were supposedly out of scope for this incident. No brand notice mentions those 144. The admin-impersonation phase of the attack apparently touched account controls for at least some members, not just read access. If you reused your community password anywhere, change it there. The list of what leaked and the list of what the attacker could reach are not the same list.
The channel you can still control
Of Yamaha Motor's nine leaked fields, the email address is the only one the member selected freely. Name, date of birth, address, gender: all dictated by the signup form. The nickname and the self-intro were chosen too, but nobody treats a nickname as a security decision. The email was the one field that could have been turned into evidence, and almost everyone handed over their real one.
That is where the AliasFleet argument lands against this breach, and where its limit gets sharper than in the earlier Commune pieces. Give each community its own email alias, forwarded to your real inbox, and a forged "PAS Life notice" arriving on an address you only ever gave to DS.LAB has identified itself on arrival. The leak-tracing mechanism fits this breach's structure exactly: one brand at a time, each wearing its own letterhead. Kill the alias and that brand's impersonation channel closes while your real inbox stays untouched. The set-up guide takes about two minutes.
State the limit plainly, because this slice makes it sting. No alias unwrites your name, your date of birth or your home address from the attacker's file. Those fields left through the signup form and no address trick brings them back. The email was the one field you chose; it is also the one field you can still make useless to the attacker. The identity fields are gone. The inbox does not have to follow.
If you were in one of these communities
The notice stings. The fix is boring on purpose.
- Do not click links in any message about this breach. Open the company's own site or app yourself, typed by hand. The forged versions will quote the real notices word for word, and now they can quote your real name too.
- Treat calls and texts that "confirm your identity" with your own details as hostile. Your name, date of birth and address are the leaked fields. Recitation is not authentication.
- Change the password anywhere you reused your community password. 144 members had theirs reset by the attacker, and credential stuffing pairs leaked emails with passwords from older breaches anyway.
- Watch for mail that knows your profile cold. Nickname, self-intro, group memberships, points, last-active times: the richer slices hold all of it.
- Check Have I Been Pwned once the incident is listed, and turn on its breach notifications.
- Walk the breach-response order of operations. It is written for exactly this.
What to watch now
Three things. First, whether more brands disclose with further field types. The richness trend has moved in one direction all week, and there is no reason to assume PAS Life is the ceiling. Second, whether the dataset surfaces anywhere public, which turns a contained intrusion into a circulating one. Nothing reported so far. Third, the forged-notice wave wearing these new identities: predicted, not yet observed at scale. The only open question is which brand's letterhead it wears first, and whether it opens with your name. The first follow-up argued the file was complete from the start. It was. We are only now learning how complete.
Top comments (0)