The points stopped at eleven

The public number is Monday’s. The stop was today’s.

GMO Research & AI’s account, published on 5 October, puts the intrusion sometime after 2 October, through a vulnerability in software the survey site was running. I am not naming an exploit. On the morning of 3 October a member noticed their points and reported it. That report is what started the look. At 11:24 the company halted point exchanges. At 14:15 it cut the path being used. At 15:00 it removed infoQ from the internet. The site has stayed on an emergency-maintenance page. GMO has since said the maintenance page was this incident.

What they said on the 5th, which belongs in the later note only as a boundary, is the scale: up to the entire member base. What belongs in today’s note is the sequence. A loyalty balance moved. A person who wanted the toaster noticed before the security team published anything. The control that mattered in the first hour was not a patch. It was refusing to convert the points.

Why a points ledger is a better signal than a portal

The portal can look like maintenance for two days, which is what this one did. The ledger cannot hide a conversion. If you run a survey panel, a wallet, or any system that turns a balance into a gift code, the page you watch is the redemption log, not the status banner you control. A customer ticket about a missing balance is an incident ticket. Routing it to support and waiting for a vendor RCA is how the afternoon gets spent while the exchange is still open.

They did close it the same day. The two days of silence after that are a communications choice. The 11:24 freeze is the security choice. Those are different clocks, and only one of them stops the gift code.