GMO Research & AI, a Tokyo-based unit of GMO Internet Group, said Tuesday that attackers stole personal records on as many as 948,498 members of its infoQ survey panel, halted the site and reported the breach to Japan’s Personal Information Protection Commission after members flagged suspicious point redemptions.
The disclosure ranks among the largest consumer-data incidents in Japan this year and combines classic credential theft with a loyalty-points heist: 611 accounts had rewards converted into Amazon gift codes totaling ¥2,869,500 without owners’ consent, according to the company’s Oct. 5 notice.
How the intrusion unfolded
GMO Research said unauthorized access began on or after Oct. 2. On the morning of Oct. 3, customer inquiries prompted an internal review that confirmed outsiders had reached infoQ servers.
The firm’s timeline shows a rapid shutdown sequence: point exchanges were frozen at 11:24 a.m., attack paths were blocked at 2:15 p.m., and external access to infoQ was cut at 3 p.m. the same day. Visitors since then have seen a maintenance page while forensic teams work inside the environment.
Executives blamed exploitation of a software vulnerability in the survey platform. They said no similar compromise had been detected on other GMO Research services, but infoQ will remain offline until engineers validate patches and monitoring rules.
What data left the building
The stolen bundle covers essentially the entire membership file GMO held as of Oct. 5. Names, phonetic name readings, gender, birth dates, email addresses, home addresses, phone numbers, hashed passwords, member IDs and usage metadata—nicknames, point balances, last survey dates—were included.
Credit card numbers and My Number national ID data were not stored on infoQ, the company emphasized. That limit matters for payment fraud risk but leaves members exposed to targeted phishing, SIM-swap attempts and password-spray attacks if they reused infoQ credentials elsewhere.
GMO Research pledged to email every affected account holder and urged anyone sharing passwords across sites to rotate them immediately.
Point fraud and reimbursement
Beyond static identity fields, attackers monetized active accounts. GMO Research confirmed 611 cases in which points were exchanged for Amazon gift codes. The company said it would reimburse the full ¥2,869,500 and is tracing how criminals authenticated those redemptions.
infoQ rewards frequent survey takers with points redeemable for GMO group services or third-party vouchers. That economy made the panel attractive: a single bulk export could pair contact details with spendable balances.
Regulatory and market fallout
Management filed a formal report with the Personal Information Protection Commission on Oct. 5. NHK and Nikkei carried the story across morning bulletins, pressuring other marketing-research firms to audit API keys and redemption portals.
Parent GMO Internet Group built its brand on hosting and finance products; a research subsidiary leaking nearly a million Japanese households’ contact paths raises questions about centralized security governance. GMO Research’s statement apologized for “entrusting precious member information” and promised a public recap once root-cause reviews finish.
What members should expect
infoQ has not announced a restart date. When service resumes, GMO Research said it would publish both investigative findings and structural fixes—likely including tighter separation between survey databases and points settlement systems.
Until then, former panelists face a familiar post-breach routine: watch for scam calls quoting accurate address fragments, enable two-factor authentication on email inboxes tied to the site, and treat any unsolicited prize message as suspect even if it references real point balances.