commune-2026 · Disclosed 2026-10-08
Commune: member data leaked through invitation and administrator impersonation
The provider reported impersonation through system flaws, an estimated 307,000 affected members including staff and demo accounts, and further abuse of a route left available during maintenance.
Outcome: Confirmed breach
Entry path and evidence
- Reported fact
The provider reported unauthorized invitation use and administrator impersonation for reading, extraction and changes.
[s1]§3 原因 - Reported fact
The estimated 307,000 affected members excludes repeated member IDs and attacker accounts but includes staff and demo accounts.
[s1]§2 影響範囲および漏えいした情報 - Reported fact
On October 7 a remaining maintenance route allowed unauthorized registration and viewing; it was blocked at 14:58 JST.
[s1]§1 経緯 - Reported fact
Password and direct-message leakage was not established; 144 members had passwords changed without their action.
[s1]§2 影響範囲および漏えいした情報
Timeline
Reported response
- Reported fact
Fixed flaws, rotated login signing keys, blocked unauthorized routes and began staged reopening after verification.
[s1]§4 当社の対応および再発防止策
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Operational controls to inspect
Inspect authorization and containment during maintenance; the exact implementation and prior checks remain undisclosed.
Editorial assessment; not a determination of liability. [s1]
Unknowns and AI involvement
The reviewed primary sources do not establish attacker use of AI.
CVE, invitation acquisition and impersonation details remain undisclosed; the estimated member count can change.
Sources
[s1] コミューン · Primary source
「Commune」「Commune for Work」への不正アクセスによる個人情報漏えいのお知らせ ↗Published 2026-10-09 · Reviewed 2026-10-12
[s2] コミューン · Primary source
青森県観光ファンコミュニティにおける個人情報漏えいの可能性について ↗Published 2026-10-08 · Reviewed 2026-10-12