Sansan User Forum: 1,325 Emails Leaked via Commune

Mon Oct 12

Sansan, Inc. (Sansan株式会社) apologised on 9 October 2026 after member information leaked from Sansan User Forum, the company’s user-facing online community hosted on external cloud service Commune (コミューン株式会社). Sansan’s notice: https://jp.corp-sansan.com/news/2026/1009.html. Commune’s platform incident: https://communeinc.com/ja/news/2026oct09. Canonical BreachHistory record: https://breachhistory.com/sansan/sansan-commune2026 (/sansan/sansan-commune2026). Related platform write-up: /commune/commune2026.

This is a verified Sansan data breach disclosure for the User Forum tenant — counts, field lists, and negative inventory come from Sansan’s October 9 release citing Commune’s investigation. What it is not: a compromise of Sansan’s core business card CRM, Bill One, Contract One, or Eight apps; those systems are explicitly out of scope in Sansan’s notice.

What happened

On 6 October 2026, Commune reported to Sansan that Commune’s systems suffered third-party unauthorised access. Commune’s investigation indicated some Sansan User Forum member information may have been viewed or taken. Sansan says the community is temporarily stopped while Sansan and Commune jointly investigate cause and impact.

Sansan stresses the attack hit Commune’s platform, not Sansan-operated production SaaS for customer relationship data. The User Forum lives on an independent external cloud stack — a common pattern for marketing communities — which means incident response spans two vendors and two notification templates.

Timeline

6 October 2026 — Commune notifies Sansan of unauthorised access; Commune stops Sansan User Forum service.
7 October 2026 — Sansan receives Commune’s preliminary investigation report (速報).
9 October 2026 — Sansan publishes corporate apology and scope; reports to Japan’s Personal Information Protection Commission (個人情報保護委員会); emails all Sansan User Forum members about the unauthorised access.
9 October 2026 — Individual guidance emailed to members in the confirmed and possible-leak cohorts.
Ongoing — Joint investigation; service restart timing to be announced when facts firm up.

What remains unknown publicly

Attacker identity and whether stolen rows appeared on criminal marketplaces — not stated in Sansan’s notice.
Exact overlap between Sansan’s tenant-level counts and Commune’s platform-wide ~307,000 member estimate across all customers.
Reopen date for Sansan User Forum.
Whether profile overwrite or vandalism occurred inside the Sansan tenant — Commune’s platform notice mentions overwrite risk globally; Sansan’s page focuses on confidentiality.

What data was exposed

Sansan publishes two cohorts based on Commune’s reporting as of 9 October 2026:

1,325 members — leak confirmed — email address, account display name, self-introduction text, profile image, and in-community group membership information.
8,687 members — leak possible — display name, self-introduction, profile image, and group membership; no email in this possible set per Sansan’s list.

Passwords are explicitly not included (パスワードは含まれていません). That aligns with Commune’s wider October 9 statement that password exports were not part of the leak narrative, aside from a small temporary-reset edge case on the platform that Sansan does not restate separately.

For search intent around Sansan User Forum breach 2026, the confirmed email population — 1,325 — is the highest-risk slice for inbox phishing. The 8,687 “possible” members still carry impersonation and deanonymization risk via display names, intros, and group graphs even without email in the attested field list.

What was not exposed — core Sansan products

Sansan’s notice lists systems with no impact on stored information:

Sansan (営業AX / business card and sales CRM)
Bill One (経理AX)
Contract One (契約AX)
Eight (名刺アプリ business card app)

If you are a paying Sansan customer whose only touchpoint is corporate CRM login, this incident does not replace your tenant security review — but Sansan says those product databases were not touched by this Commune path. Forum members who reused the same password on Sansan CRM should still rotate credentials as hygiene; Sansan says forum passwords were not leaked as part of this incident’s field list.

How the attack worked — Commune platform context

Sansan attributes the incident to unauthorised access against Commune’s systems hosting the User Forum. Commune’s own October 9 release describes invite-link abuse and admin impersonation across the shared SaaS platform between roughly 5–7 October 2026. Sansan’s customer notice does not re-document those mechanics but points readers to Commune’s release for vendor-root-cause detail.

Readers comparing incidents should consult Commune’s platform breach overview and the canonical row /commune/commune2026 for cross-tenant context. Sansan’s numbers are tenant-specific; Commune’s ~307,000 figure is platform-wide across many brand communities.

Who is at risk

Confirmed cohort (1,325) — expect targeted email referencing Sansan User Forum, Commune, or AX product names; attackers know your mailbox if it was in the confirmed set.

Possible cohort (8,687) — lower direct email exposure per Sansan’s table, but intros may mention employers, job titles, or cities; group lists reveal professional interests tied to Sansan’s user base.

All forum members — Sansan emailed the entire membership about unauthorised access even if you are outside the 1,325 / 8,687 buckets; read your mail carefully and distinguish official Sansan domains from lookalikes.

Sansan enterprise customers — your employee advocates or power users who joined the public forum may need internal comms support; this is not a Bill One invoice leak per Sansan.

Phishing patterns after the Sansan User Forum leak

Fake “Commune password reset” or “Sansan forum reopening” links.
Bill One or Contract One themed lures — ironic given those products were not breached, but scammers will blur brands.
Malicious profile “security verification” forms harvesting CRM credentials.
Japanese and English mixed mail citing October 2026 APPI reporting — official Sansan contact for forum issues: [email protected] (Sansan Innovation Community office).

Industry and campaign context — Japan’s October Commune wave

Commune’s early-October 2026 incident rippled across multiple enterprise communities. Sansan and Panasonic published tenant-specific counts the same week, while Commune described platform-wide exposure on the order of hundreds of thousands of member profiles across customers. Each brand notice should be read on its own field list — do not sum Sansan and Panasonic headcounts into a fictional “unique persons across Japan” total.

Sansan sits in Japan’s B2B SaaS elite; forum members skew toward sales, marketing, and IT professionals who experiment with Sansan’s ecosystem. That makes intros and group memberships useful for spear-phishing against corporate tenants even when CRM data stayed put.

What Sansan and regulators said

Sansan apologised for worry and inconvenience, confirmed Commune service stop on 6 October, documented PPC reporting on 9 October, and said it will tighten supervisory control (管理監督) over Commune’s recurrence prevention work. Future reopening or newly discovered facts will be posted on the website and communicated individually to affected members.

Questions route to Sansan Innovation Community運営事務局 at [email protected] per the notice footer.

What you should do

Read Sansan’s October 9 notice at jp.corp-sansan.com and Commune’s release at communeinc.com.
Check email (including spam) for Sansan’s individual notice if you are in the 1,325 confirmed or 8,687 possible groups.
Do not reply with passwords to any “Sansan security survey” — forum passwords were not in the leaked set, but CRM passwords should never be emailed.
Navigate to Sansan services via bookmarks, not links in unexpected forum mail.
Rotate reused passwords if your forum password matched Sansan CRM or Eight — defense in depth despite Sansan’s negative list.
Report suspicious mail to [email protected] using headers from the suspicious message.
Bookmark /sansan/sansan-commune2026 for scope updates.

Was I affected?

If you registered on Sansan User Forum, you received at least the general unauthorised-access email on 9 October. Confirmed impact requires matching to the 1,325 email-inclusive rows or the 8,687 possible non-email rows per Sansan’s Commune-sourced tables. Sansan does not describe a public lookup portal; wait for individualized mail if you are in those sets.

If you never joined the forum, this incident does not implicate your Sansan CRM tenant data per the company’s product-level exclusions.

Commune vs tenant responsibility

Sansan’s notice makes clear legal and operational split: attack on Commune infrastructure, Sansan as community operator responsible for member communication and PPC reporting. Enterprise customers negotiating community SaaS should review incident-notification SLAs, subcontractor audit rights, and whether marketing forums share SSO with production apps — here, Sansan says they do not share data stores with CRM SKUs.

Field-by-field stakes

Email (1,325 confirmed) enables direct phishing and credential-stuffing against the mailbox provider, not against Sansan forum passwords (excluded). Display names and intros help attackers craft plausible LinkedIn or Eight-themed lures. Profile images assist impersonation accounts. Group membership reveals product interest (integrations, admin features) useful for targeted social engineering against Sansan sales engineers or partners.

Comparison to platform-wide Commune numbers

Commune estimated roughly 307,000 members affected across all hosted communities with about 126,000 emails in scope platform-wide. Sansan’s 1,325 confirmed emails is a subset — one tenant’s slice. Security journalists should not present Sansan’s blog as “307k Sansan emails” without conflating unrelated brands.

Eight, Bill One, Contract One — customer reassurance

Sansan’s explicit negative inventory is rare and valuable: finance and contract workflows often hold bank and invoice metadata. Sansan states those AX products were not impacted on this path. Continue normal fraud monitoring on AP workflows, but do not cancel Bill One over this forum incident alone based on published facts.

Service pause and member experience

User Forum suspension means event archives, discussion threads, and peer support content may be unavailable temporarily. Sansan promises updates on reopening. Archive sensitive posts you may need for your own records once service returns — Commune’s platform notice mentioned overwrite activity globally; Sansan has not confirmed overwrite inside its tenant.

APPI reporting timing

PPC report on 9 October aligns with same-day public release — a tight loop suggesting Sansan treated Commune’s preliminary counts as reportable without waiting for final forensic sign-off. Counts may be revised if Commune refines de-duplication; watch both vendors.

English-language readers

Sansan’s authoritative text is Japanese. This BreachHistory draft summarizes attested numbers and fields for international staff at multinationals using Sansan Japan instances. When legal teams need verbatim wording, cite the Japanese primary page.

Enterprise tenants — internal comms template

IT leaders at companies whose employees joined Sansan User Forum should: (1) identify users with @company.com emails in the 1,325 set via Sansan mail forwarded by employees; (2) warn help desks about forum-themed phishing; (3) avoid forcing password resets on unrelated SSO apps unless reuse is policy violation.

Technical integration lessons

Community platforms rarely receive the same pen-test cadence as core CRM. Sansan’s incident is a case study in isolating marketing community PII from AX systems — architecturally separated per notice, yet reputational coupling remains.

Long-tail monitoring

Forum email addresses may appear in combo lists months later labeled “Sansan” or “Commune.” Monitor breach-notification services if you used a dedicated alias for the forum.

Invite-link abuse — why Sansan members should read Commune’s notice

Sansan’s customer-facing page is concise; Commune’s October 9 release explains that attackers abused private invite links, registered as members, then impersonated community administrators to view, export, and in some cases overwrite member data. Sansan User Forum inherits that root cause even though Sansan did not operate the vulnerable control plane.

Forum moderators and Sansan developer relations staff should assume admin-role social engineering continues after reopening: verify any “urgent API key test” or “new SSO pilot” post through official Sansan channels, not DM alone.

Notification email to all members — parsing the wording

Sansan says it emailed all Sansan User Forum members about unauthorised access on 9 October, while individualized guidance went only to the 1,325 and 8,687 cohorts. If you received the general mail but not a second detailed letter, you may still be outside the confirmed/possible tables — but you should still treat forum-themed phishing as live because attackers touched the tenant during the Commune window.

Multinational customers and forum participation

Sansan sells globally; the User Forum historically mixes Japanese enterprise users with English-speaking admins evaluating integrations. Email addresses in the 1,325 set may include @multinational.com addresses — those inboxes often forward to SOC queues slowly. Forward Sansan’s individualized notice to corporate security if it landed in your personal alias.

Why community passwords being excluded still matters

Sansan’s bold line that passwords were not included should appear in every internal FAQ. It does not eliminate risk: password-reset flows for the forum email address, OAuth tokens if Commune supported social login, and reused CRM passwords on other sites remain practical attack paths. Mandate unique forum credentials on reopen.

Vendor management checklist for SaaS operators

Require Commune (or any community vendor) to provide tenant-specific exfiltration manifests, not only platform totals.
Contractually oblige same-day processor notice when the vendor stops service — Sansan’s 6–9 October sequence is a benchmark.
Map which employees may join public forums with corporate email — consider plus-addressing or ban corporate domains in public communities if policy demands.
Pre-draft PPC reporting templates per tenant to avoid waiting for English translations during APPI clocks.

Reputation coupling between forum and AX brands

Even with technical isolation, media will say “Sansan breached.” Communications teams should lead with product negative inventory (Bill One safe, etc.) while acknowledging real harm to 1,325 mailboxes. Minimizing forum impact angers advocates; overstating CRM risk erodes trust with CFO buyers.

Forensic revision risk

Counts come from Commune investigation “as of 9 October.” De-duplication, restored backups, or log gaps may shrink or grow cohorts. Sansan promises website updates and individual contact if new facts emerge — refresh your personal plan if a second Sansan email arrives.

Canonical record and sources

BreachHistory indexes Sansan User Forum as company-confirmed Commune-path unauthorised access on 6 October 2026 with Sansan notice 9 October: 1,325 confirmed (email plus profile fields), 8,687 possible (profile fields without email), passwords excluded, core Sansan/Bill One/Contract One/Eight unaffected, PPC reported, forum paused.

Sansan User Forum members should treat 1,325 confirmed emails as inbox-risk reality and 8,687 possible profiles as impersonation-risk reality, while remembering Sansan’s CRM and AX apps were not in scope. Read Sansan and Commune primary notices, ignore Bill One payment lures tied to this forum leak, and use [email protected] for official questions.