Who this affects: members of the GFS member site (including people who have left), people who applied, and people who sent an inquiry. Especially people who submitted ID documents or images of their My Number Card. This article is based on GFS Education's official notice and does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
members of the GFS member site (including people who have left), people who applied, and people who sent an inquiry. Especially people who submitted ID documents or images of their My Number Card.
- Confirmed so farSee the table ↓
- Discovery
- Taken outside
- Cause
Listed as possibly affected
- Count (personal information)
- Name, email address, date of birth, phone number, address
- Password-related information
4 more
- Viewing and purchase history, inquiry content
- Submitted homework images
- Images of ID documents
- Back of the My Number Card (with the individual number)
- Not yet confirmed
- Full scope of impact (under investigation)
- Which ID documents' images are included
- Completion of individual notices
2 more
- Whether the data has been misused
- A phone contact point (not in the notice)
- What to do nowSee the steps ↓
- Change your member-site password
- If the back of your My Number Card is involved (84 people): wait for the individual notice and ask about the number
- If you submitted ID documents: watch for contracts and bills you did not make
4 more
- Do not respond to contact that uses the company's or a public agency's name (including notice emails)
- Look over your card statements (as a precaution)
- If you are worried, use the official contact point
- If you entered details or sent money, get help right away
- Where to verify (source)All sources ↓
- GFS Education Inc., "Apology and notice regarding personal information leakage due to unauthorized access to the GFS member site" (November 13, 2026, in Japanese)
- Last checked
- As of November 15, 2026
Follow-up plans and what we checked
The company says it is still investigating the full scope. When new facts emerge, it says it will update its site and, as needed, contact affected people again. We checked the company's notice on November 15, 2026 and found no update since the November 13 notice.
What affected people should do today
Change your member-site password
The company says password-related information may also have leaked and asks you to change your password as soon as possible. It describes the data as values protected when stored, but if you use the same password on other services, those may be affected too (our view).
Log in to the member site, open "Account Settings" from the icon at the top right, and use "Change Password" in the password field. Go through your usual bookmark, not a link in an email. The company also asks you to change the password on any other service where you used the same one. To check reuse, see How to check if your password has leaked; for two-step login, see Setting up multi-factor authentication.
If the back of your My Number Card is involved (84 people): wait for the individual notice and ask about the number
The company says it had saved the images of the back of the My Number Card that some people submitted. Because the back shows the 12-digit individual number, it says that number leaked or may have leaked. This covers 84 people.
The company says leakage of ID documents or the individual number does not by itself lead to immediate misuse. It adds that if the individual number has leaked and is judged to be at risk of misuse, you can ask the municipality where you live to change it. Read the company's individual notice first, then ask your municipal office. National government guidance (the Digital Agency FAQ and the My Number Card general site FAQ, in Japanese) says the number is in principle kept for life, that it can be changed only when it has leaked and is judged to be at risk of misuse, on the person's application or at the municipal mayor's initiative, that you cannot choose the number, and that you should consult the municipality where you live. This is general information and not about this incident.
The notice does not say whether the card itself needs to be reissued.
If you submitted ID documents: watch for contracts and bills you did not make
The company says that if images of ID documents are misused, a third party could pose as you and apply for contracts with various services or credit cards. The notice does not say which documents (such as a driver's license) are included.
If a notice, mail or bill arrives for a contract you did not make, check with that business through its official contact point, and consult the police or a consumer center if needed (Consumer Hotline 188 in Japan). Steps by document type are in What to do when a driver's license or ID document leaks.
Do not respond to contact that uses the company's or a public agency's name (including notice emails)
The company says leaked information could be used to send suspicious emails or calls that pretend to be the company or a public agency. If you get contact you do not recognize, do not open the URLs, do not open attachments, and do not give personal information.
The company's individual notices go to your registered email address. A fake message can arrive the same way (our view), so do not open links in the email; change your password or check things from the member site you open yourself. How to tell the difference is in What is phishing?.
Look over your card statements (as a precaution)
The company says it stores card numbers partly masked and that leakage of full numbers has not been confirmed. The notice does not say you need to reissue your card for this incident alone. As a precaution, check the statement of any card you used on the member site for charges you do not recognize.
If you are worried, use the official contact point
The contact point in the notice is the email address of the GFS Education Customer Support Desk: privacy(at)gfse.jp (replace "(at)" with "@" when sending). The notice gives no phone number or hours.
Use the contact point in the official notice, not one written in an email or SMS.
If you entered details or sent money, get help right away
If you entered personal information on a suspicious link or sent money, contact your bank or card company right away. You can also call the police advice line (#9110 in Japan) or the Consumer Hotline (188). To check an account for suspicious activity, see How to check for unauthorized access.
What happened (from GFS Education's notice)
On November 13, 2026, the company posted a notice about personal information leakage from unauthorized access to the GFS member site. Everything below is what the company says.
November 9
The company detected an abnormal load on the server, investigated and found that a third party had gained unauthorized access. It immediately cut communications and took steps to stop the damage from spreading.Found in the investigation
It was confirmed that a flaw in the image upload feature was exploited and that information in the database and image files stored on the server were taken outside. The company is still investigating the full scope.Response
Blocked communications from the attacker, isolated the malicious program, reduced server permissions and changed the database password. Fixed the program flaw that caused it. Filed a damage report with the police and reported to the Personal Information Protection Commission.November 13
Posted the notice. Said it will contact affected people one by one in turn at their registered email address.
- Discovery
- November 9, 2026 (an abnormal load led to an investigation that found unauthorized access by a third party). The notice does not say when the access began
- People affected
- Personal information on about 110,000 people. Of these, information containing the individual number (My Number): 84 people
- Information that leaked or may have leaked
- Name, email address, date of birth, password-related information (values protected when stored), phone number, address, viewing and purchase history, inquiry content, submitted homework images, images of ID documents. For 84 people, images of the back of the My Number Card
- Not included
- Full credit card numbers (stored partly masked; leakage of full numbers not confirmed so far)
- Cause
- A program flaw in the image upload feature was exploited and a malicious program was placed and run; a flaw in the server's access permission settings
- Contact
- Customer Support Desk privacy(at)gfse.jp (no phone number or hours given)
What is known and what is not
This is based on the company's notice of November 13, as of November 15, 2026. The company lists the personal information below as information that leaked or may have leaked, and says the items differ from person to person. When there is news, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Discovery | Found on Nov 9 after an abnormal load led to an investigation | Confirmed (company) |
| When the access began | Not stated | Not stated |
| Taken outside | A flaw in the image upload feature was exploited, and database information and image files were confirmed taken outside | Confirmed (company) |
| Count (personal information) | About 110,000 people (members and former members, applicants, people who sent inquiries) | Possible (company; items differ by person) |
| Name, email address, date of birth, phone number, address | Among the information that leaked or may have leaked | Possible (company) |
| Password-related information | Values protected when stored. May have leaked | Possible (company) |
| Viewing and purchase history, inquiry content | Among the information that leaked or may have leaked | Possible (company) |
| Submitted homework images | Among the information that leaked or may have leaked | Possible (company) |
| Images of ID documents | Included. Which documents is not stated | Possible (company); type not stated |
| Back of the My Number Card (with the individual number) | 84 people. The 12-digit individual number leaked or may have leaked | Possible (company) |
| Front of the My Number Card | Not stated | Not stated |
| Credit card numbers | Stored partly masked; full numbers are not kept. Leakage of full numbers not confirmed | Not confirmed (company) |
| Cause | A program flaw in the image upload feature was exploited and a malicious program was placed and run; a flaw in the server's access permission settings | Confirmed (company) |
| Misuse | No confirmed misuse found in the notice. It says suspicious contact and impersonation may occur | Not stated |
| Full scope of impact | Still under investigation | Under investigation (company) |
| Authorities and police | Reported to the Personal Information Protection Commission; damage report filed with the police | Done (company) |
| Individual notices | The company says it will contact people in turn at the registered email address, tailored to each person's data. It does not say whether this has started | Planned (company; start not stated) |
What can happen with information that leaked or may have leaked
- Genuine-looking emails and calls that use the company's or a public agency's name
- Contract applications to other services or card issuers using images of ID documents
- Unauthorized logins to other services that share the same password (our view)
- For people whose My Number Card back is involved, the individual number becoming known
What the notice says has not been confirmed
- Leakage of full credit card numbers
- Misuse (the notice does not say any has been confirmed)
For operators: how to hold images of submitted documents
The cause has been disclosed only in outline, so this covers only what the disclosed facts support.
- Do not keep the images on the server indefinitely: the company writes that the images submitted included the back of the My Number Card and that it had saved them in the system. Setting a retention period and scope for ID document images, and deleting them when no longer needed, is generally effective. Japanese law also limits the purposes and scope of handling My Number.
- Check the upload feature and server permissions: the cause was a flaw in the image upload feature and a flaw in the server's access permission settings. Validating the type and storage location of uploaded files, giving them no execute permission, and keeping server permissions to the minimum are generally effective safeguards.
Sources (public records)
The facts in this article are based on the official notice below. We have not guessed at causes that were not disclosed.
- GFS Education Inc., "Apology and notice regarding personal information leakage due to unauthorized access to the GFS member site" (November 13, 2026, in Japanese) — gfse.jp
- General conditions for changing an individual number (national government guidance): Digital Agency, My Number FAQ — digital.go.jp / My Number Card general site, FAQ (in Japanese) — kojinbango-card.go.jp
Update history
2026-11-15: First version. Based on GFS Education's notice of November 13. We checked the company's notice the same day and found no follow-up.
Read next
- When ID documents leak: What to do when a driver's license or ID document leaks / The Lashinbang incident (ID documents and bank details)
- How to spot fake contact: What is phishing?
- Checking passwords and two-step login: How to check if your password has leaked / Setting up multi-factor authentication
- Suspicious activity on an account: How to check for unauthorized access
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)