The gift code was the proof

The member count is a ceiling. The gift codes are a receipt.

GMO Research & AI said today that the infoQ survey panel was breached, and that up to 948,498 people, the whole member base, may have had email addresses, names, phone numbers, and home addresses taken. The intrusion, in their account, began after 2 October through a vulnerability in software on the site. The morning of 3 October is when a member saw the points move. They froze exchanges, cut the path, and took the site offline that same day. They reported it to Japan’s Personal Information Protection Commission today, and they started mailing members.

Inside that ceiling, one number is not a ceiling. In 611 accounts the attacker converted points into Amazon gift codes, without the member doing it. Total: 2,869,500 yen. GMO says those points will be compensated in full, and that as of today’s announcement it has not confirmed other misuse. “No other misuse” is a statement about what they have seen by 5 October. The 611 are what they have already counted.

Why the compensation line will be over-read

Paying the points back makes the member whole on the balance. It does not unpublish a home address, and it does not tell you whether the gift codes were redeemed. A survey panel’s inventory is boring on purpose: name, email, phone, address, a points balance. Boring is how it gets reused. The email is the key to every other site that accepted it. The address is the key to the door.

If you are in the 611, the gift code is the evidence, not a coupon. If you are in the other several hundred thousand, you are in the “may have” until a letter says otherwise, and the practical assumption is that the email and the address left. Do not wait for a second misuse to be confirmed before you treat the address as exposed. They already told you the shutdown page was the incident. Believe that sentence, and believe the yen figure more than the round member count.

A vulnerability got them in. A redemption API told you they were real.