GMO Research & AI says up to 948,498 infoQ members' data breached; site halted
Version 2: Additional Japanese outlets — NHK, Sankei Shimbun, Tokyo Shimbun, Livedoor News and Nishi-Nippon Shimbun — reported the breach on October 6, broadening confirmation of the scale and the fraudulent point exchanges; no new facts about the incident itself emerged.
In short
GMO Research & AI said a vulnerability in its survey site infoQ was exploited and personal data for up to 948,498 members was taken out. Points worth about 2.87 million yen were exchanged without members' consent, which the company said it will compensate in full. The site has been offline since October 3.
Read the full story 2 min read
GMO Research & AI, a company under the GMO Internet Group, said a vulnerability in its survey site infoQ was exploited in an unauthorized access that took out personal information for up to 948,498 members — effectively the site's entire membership, according to ITmedia. NHK reported the figure as more than 940,000 members' names, addresses and other personal information, while Sankei Shimbun, Livedoor News and other outlets described a maximum of about 950,000. ITmedia said the company announced the breach on October 5; Sankei and Livedoor said the company disclosed it by October 6. The service has been stopped since October 3. [ 1 , 2 , 3 , 4 , 5 , 6 ]
According to ITmedia, the data involved includes name, furigana, gender, date of birth, email address, address, phone number, encrypted password and member ID, as well as usage information such as nickname, point balance and last answer date. In 611 cases, points were exchanged without the member's consent for Amazon gift codes totaling 2,869,500 yen, the company said. ITmedia and Sankei reported that the company will compensate the fraudulently exchanged points in full, a figure Livedoor put at about 2.86 million yen. [ 1 , 3 , 5 ]
The company said the unauthorized access began on or after October 2. It started investigating after a member inquiry on the morning of October 3, ITmedia reported: point exchanges were halted at 11:24, the attack route was blocked at 14:15, and external access to infoQ was blocked at 15:00, when the service was stopped. [ 1 ]
GMO Research & AI said it has not confirmed unauthorized access to any of its services other than infoQ. It said infoQ will resume after countermeasures are put in place and its safety is confirmed, and that it will publish the investigation results and preventive measures at a later date. Affected members will be contacted individually by email, and the company advised members who use the same password on other services to change it there. [ 1 ]
Why it matters
The breach covers nearly the entire infoQ membership and includes names, addresses, phone numbers and encrypted passwords, so affected users face phishing and password-reuse risks. The company has stopped the service and says it will restart only after countermeasures are in place, leaving the survey platform unavailable meanwhile.
Key facts
- GMO Research & AI, a GMO Internet Group company, said its survey site infoQ was breached through an exploited vulnerability, with personal data for up to 948,498 members taken out. [ 1 ]
- NHK and business outlets reported the figure as more than 940,000 or a maximum of about 950,000 members. [ 2 , 3 , 4 , 5 , 6 ]
- In 611 cases, members' points were exchanged without their consent for Amazon gift codes totaling 2,869,500 yen. [ 1 ]
- The company said it will compensate the fraudulently exchanged points in full. [ 1 , 3 , 5 ]
- Data involved includes name, furigana, gender, date of birth, email address, address, phone number, encrypted password, member ID, nickname, point balance and last answer date, according to ITmedia. [ 1 ]
- The service was stopped on October 3 and the company said it will resume after countermeasures are in place and safety is confirmed. [ 1 , 3 , 5 ]
- The company said it has not confirmed unauthorized access to any of its services other than infoQ. [ 1 ]
Confirmed by several sources
- GMO Research & AI, part of the GMO Internet Group, reported unauthorized access to its survey site infoQ affecting personal data of up to about 950,000 members. [ 1 , 2 , 3 , 4 , 5 , 6 ]
- The leaked data includes members' names and email addresses. [ 1 , 2 , 3 , 5 ]
- Points worth about 2.86 million yen were fraudulently exchanged, and the company said it will compensate them in full. [ 1 , 3 , 5 ]
- The service was stopped on October 3. [ 1 , 3 , 5 ]
- The unauthorized access dates to October 2. [ 1 , 3 , 5 ]
Still unclear
- Whether the final figure for leaked records is 948,498 or a figure of more than 940,000. ITmedia gives a precise maximum of 948,498 records, while NHK says more than 940,000; Sankei and Livedoor say a maximum of about 950,000. The documents do not reconcile the figures.
- Whether the personal data taken out has been misused beyond the point exchanges. The documents describe only the 611 cases of unauthorized point exchange and state no other use of the data.
- Who carried out the unauthorized access, and how. No document identifies an attacker or names a method beyond saying a vulnerability was exploited.
- When the infoQ service will resume. The company said it will resume after countermeasures and a safety check, but no date is given.
- Whether the company announced the breach on October 5 or by October 6. ITmedia dates the announcement to October 5, while Livedoor and Sankei say the company disclosed the matter by October 6; the documents do not reconcile this.
What local media are saying
Timeline, local time
- Unauthorized access to infoQ begins on or after October 2. [ 1 , 3 , 5 ]
- On October 3, the company halts point exchanges after a member inquiry leads to an investigation. [ 1 ]
- The company blocks the attack route. [ 1 ]
- External access to infoQ is blocked and the service is stopped. [ 1 ]
- On October 5, the company announces the breach. [ 1 ]
- ITmedia publishes its report. [ 1 ]
- NHK publishes its report. [ 2 ]
- Livedoor News publishes its report. [ 3 ]
- Tokyo Shimbun publishes its report. [ 4 ]
- Sankei Shimbun publishes its report. [ 5 ]
- Nishi-Nippon Shimbun publishes its report. [ 6 ]