Breaches and incidents
GMO Research & AI (infoQ survey site): software vulnerability exploited, up to 948,498 members’ data taken and points cashed out
GMO Research & AI said a third party exploited “a vulnerability in software used on the site” from 2 Oct and took member data (up to 948,498 records.
- Disclosed
- Verification
- Checked against a primary source
What happened
- GMO Research & AI said a third party exploited “a vulnerability in software used on the site” from 2 Oct and took member data (up to 948,498 records: name, gender, DOB, email, address, phone, encrypted password, member ID); 611 members’ points were exchanged for Amazon gift codes worth 2,869,500 yen.
- Root cause: exploitation of a software vulnerability (not named).
- No attacker named.
- Points exchange halted, the route blocked and infoQ suspended on 3 Oct; the PPC was notified 5 Oct and points will be reimbursed.