What GMO Research & AI disclosed about the infoQ data breach
The infoQ data breach began on October 2, when an outside party got into the site and copied member data. infoQ is a Japanese site where members answer online surveys and collect points that can be swapped for Amazon gift codes or GMO Points. GMO Research & AI only learned of the intrusion the next morning, after members contacted it with questions.
On October 5 the company notified the Personal Information Protection Commission, Japan's privacy regulator, published its notice and began emailing affected members. The notice is signed by the company's president and CEO.
How GMO Research & AI responded on October 3 (Japan time)
While infoQ was down, the site only said it was under "emergency maintenance." The notice now admits the shutdown was a response to the attack and apologizes for not saying so sooner.
"10月2日（金）以降 第三者による不正アクセス（その後の調査で判明）／10月3日（土）午前 会員さまからのお問い合わせを受けて調査した結果、不正アクセスが行われていたことを確認" — Section 2, timelineView official source →
Which personal data was exposed and how many members
Up to 948,498 records were taken, and that figure covers every member record the company holds. Any current infoQ member should assume their details are in the stolen set.
| Type | Fields |
|---|---|
| Identity | Name, name reading (furigana), gender, date of birth |
| Contact | Email address, home address, phone number |
| Login | Password (encrypted), member ID |
| Account activity | Nickname, point balance, date of last survey |
The company says it never held credit card information or My Number, Japan's national ID number, so neither is involved. Data on its business clients is not affected either, and it has found no break-ins at its other services.
"(1) 件数 最大94万8,498件（10月5日時点。当社が個人情報を保有している全件）／(3) 含まれない情報 クレジットカード情報、マイナンバーを保有しておりません。" — Section 3, data involvedView official source →
Points turned into Amazon gift card codes in 611 cases
Beyond the stolen records, points in 611 member accounts were swapped for Amazon gift codes without the members' consent, worth 2,869,500 yen in all. Members lost points with real value on top of the data exposure.
GMO Research & AI says it will cover the full amount. Point exchanges have been frozen since 11:24 on October 3. Members who see an exchange they did not make are asked to email the infoQ support center, which takes messages around the clock and replies on weekdays from 10:00 to 18:00 Japan time.
"一部の会員さま（611件・2,869,500円）のポイントが、ご本人の意思によらずAmazonギフトコードに交換されたことを確認しております。／不正に交換されたポイントは、当社が全額を補填いたします。" — Section 4, unauthorized point exchangesView official source →
A software vulnerability caused the security breach
GMO Research & AI says the attacker got in by exploiting a vulnerability in software used on its site. The notice does not name the software, and an outside security firm is helping with the investigation.
The November 11 final report sets infoQ's return for 11:00 on November 18, 2026. The shutdown is also holding up some of the survey work GMO Research & AI does for corporate clients.
"第三者が、当社サイトで使用していたソフトウェアの脆弱性を悪用して侵入したことを確認しております。" — Section 5, causeView official source →
What infoQ members should do about passwords and phishing
The company asks members to do two things: change reused passwords and treat any message claiming to be from infoQ with suspicion. The stolen passwords were encrypted. Even so, if you used your infoQ password anywhere else, change it on those sites now.
The stolen data includes email addresses, phone numbers and home addresses, and GMO Research & AI warns members about suspicious emails, texts and phone calls that pose as the company or infoQ. Do not log in or enter details through links in those messages, since infoQ itself is still offline.
Aflac Japan gave a similar warning after its own breach, covered in Aflac data breach in Japan hits 4.4M customers. If you need a new password that is not reused anywhere, the password generator below can make a random one in a few seconds.
"パスワードは暗号化されておりますが、念のため、infoQと同じパスワードを他のサービスでもお使いの場合は、そのサービスのパスワードを変更されることをお勧めします。／当社やinfoQを装った不審なメール、SMS、電話にご注意ください。" — Section 7, requests to membersView official source →
FAQ
- Was my infoQ account part of the breach?
- Assume yes if you were a member. GMO Research & AI says the exposed records, up to 948,498 as of October 5, are every record of personal data it holds. The company started emailing affected members one by one on October 5. Its November 11 final report put the confirmed number of records taken at 894,082 (GMO Research & AI, November 11, 2026).
- Will I get my stolen infoQ points back?
- Yes. The company says it will cover the full amount for the 611 cases in which points were turned into Amazon gift codes without the member's consent, worth 2,869,500 yen in total. In its November 11 final report the company confirmed 643 fraudulent exchanges worth 2,955,000 yen in total (639 Amazon gift code cases worth 2,953,000 yen), affecting 453 members (GMO Research & AI, November 11, 2026). If you spot an exchange you did not make, contact the infoQ support center.
- When will infoQ come back online?
- In its November 11 final report, GMO Research & AI said it will reopen infoQ at 11:00 on November 18, 2026, with a new login method that requires a Google account (GMO Research & AI, November 11, 2026).
Related articles
Daiwa Securities data breach: 5 firms, one vendorDaiwa Securities data breach: a hack of Scala Communications' i-ask FAQ system may have exposed up to 713,126 inquiry records from five client firms.
AI cyber attack: AI agents hit 27 firms for $25In an AI cyber attack disclosed by Gambit Security, three open source AI agents breached at least 27 retailers and took 600,000+ cards for about $25 a target.
AI hacking hit Korean banks: what is confirmedCrowdStrike says an attacker used the ARTEX AI hacking tool and LLMs on South Korean banks. What is confirmed, what regulators ordered, and what is unknown.
Aflac data breach in Japan hits 4.4M customersThe Aflac data breach in Japan exposed data on about 4.4 million customers between June 10 and 25, 2026. What leaked, why it went unnoticed, and what to do.