For: people registered as members (panelists) with Qzoo, a Japanese survey site, and anyone who runs a service that holds members' bank account details, for example to pay rewards. This article is based on the official notice from Monitas Inc. and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 28, 2026Not yet known
- Which items actually leaked, and how many records (the company is identifying them)
- Number of people (the notice counts records)
- How passwords were stored
- What was changed when the database was 'updated'
- Details of the cause and recurrence-prevention measures
- When the service will resume
- How and when affected people will be contacted individually
The company says it will announce investigation results, new facts and the outlook for resuming the service on the Qzoo notice screen as soon as they are known. On October 28 we checked the company's news list and the Qzoo site: Qzoo was still showing the notice, and no follow-up on this incident had been published.
What members should do today
Change the password on any service that shares your Qzoo password
The company asks members who use the same email address and password combination as Qzoo on other services to change the password on those services promptly. It has not said how passwords were stored.
Once an email and password pair is known, it may be tried on other sites. Start with email, online banking, online shopping and points services, and use a different password for each service. A password manager is the realistic way to do the inventory. Also turn on two-step verification for your email account.
As for the Qzoo password itself, the company says it will ask all panelists to reset it when the service resumes.
Do not open links or attachments in emails or texts claiming to be Qzoo or Monitas
The company warns about emails, texts and similar messages posing as Qzoo or the company, and says it will never contact members asking them to enter a password or other information. It asks members not to open URLs or attachments in suspicious emails.
The company says it will contact affected people individually in turn, so genuine and fake messages may arrive at the same time. If you receive a message about "confirming your reward payment account", "resetting your password" or "an apology", do not use the link in it; check the notices on the company's official website instead (see What is phishing?).
Never give your PIN or login details to anyone claiming to be a bank or the police (this site's advice)
This step and the next are this site's advice, given because account numbers, branch names and account holder names are in scope. They are not requests made in the company's notice.
An account number and holder name are details you give out so that people can pay you; on their own they cannot be used to withdraw money. Withdrawals and transfers require things like your cash card and PIN, or your online banking login and authentication codes. The thing to watch for is a contact from someone claiming to be your bank, the company or the police who uses your account details to sound genuine and says your account is being misused or that they need to confirm your payment account.
As general guidance, the Japanese Bankers Association says it never asks for customers' PINs or passwords, and Japan's National Police Agency says police officers never ask for PINs by phone or similar means. Never give out your PIN, login details or one-time passwords (single-use authentication codes) by phone, email or text.
Check your passbook or banking app for transactions you do not recognize (this site's advice)
Check the passbook or banking app for the account you registered with Qzoo for deposits, withdrawals or debits you do not recognize. If you find any, contact your bank immediately using the number on your passbook, the back of your cash card or the bank's official website. Do not call a number given in a message you received. The National Police Agency likewise asks people who find unauthorized withdrawals made through cashless payment services to contact both the bank or other provider and the police.
The company's notice does not ask members to contact their bank. We have found no official guidance saying that an account must be replaced just because its number may have leaked.
Be wary of suspicious post and contacts sent to your home
The company warns about suspicious post and contacts sent to members' homes. Because addresses and dates of birth are in scope, convincing fake contacts can come not only by email but also by postcard, letter or phone.
A sender who correctly states your name, address, date of birth or registered bank account is not proven genuine by that. Those are exactly the details that may have leaked. For enquiries, use the contact given in the notice (Qzoo customer enquiries: qzoo_support@monitas.co.jp) or contact details you have checked on the company's official website.
What not to do
Do not open a "Qzoo login page" from a link in an email or text and enter your password. As of October 28, Qzoo is suspended, and the company says it will ask members to reset passwords when the service resumes. Any message asking you to log in or enter a password now should be treated as suspicious first.
To check whether your email or password has appeared in past leaks, follow How to check if your password was leaked. Do not type the password itself into an unfamiliar site to check it.
What happened (from Monitas's notice)
Monitas Inc. published its apology and notice on October 21, 2026, on both its corporate website and the Qzoo site. Everything below is as stated in the company's notice. Times are Japan time.
Oct 17, 2026 (Sat) 8:30
Unauthorized access by a third party begins.Oct 17, 12:22
The database is viewed and updated through SQL injection.Oct 17, 18:44
The incident is detected and the third party's access is blocked.Oct 17, 19:02
Qzoo is put into emergency maintenance (the service has been suspended since that day).Oct 20 (Tue) 18:07
Preliminary report to the Personal Information Protection Commission. The company says it reported to and consulted the commission and relevant bodies that day.Oct 21 (Wed)
Apology and notice published.
- Scope
- About 400,000 records (as of Oct 17; all records held in the Qzoo system)
- Items
- A database storing the following may have been affected, and the company is working to identify exactly what: basic information (name, date of birth, address, phone number, email address, etc.), member authentication information (member ID, password, etc.), financial information (account number, branch name, account holder name, etc.), survey answers (annual income, occupation and other attribute data obtained by the company, etc.)
- Not included
- The company does not hold credit card data or My Number
- Cause
- The company confirmed that a third party exploited a vulnerability in its system to get in. It is continuing to investigate the cause and scope with the cooperation of outside specialists
- Scope limits
- Qzoo runs on a dedicated system independent of the company's other systems, and no unauthorized access to those other systems has been found
- Response
- The service was suspended and emergency measures such as blocking access were taken. The company will put recurrence-prevention measures in place based on the investigation and resume the service once safety is confirmed
- Passwords
- All panelists will be asked to reset their password when the service resumes
- Contact
- Qzoo customer enquiries, qzoo_support@monitas.co.jp
Separate notices at the same time (response to a PHP vulnerability)
On October 23, 25 and 26 the company published notices saying it had temporarily suspended its corporate website (resumed October 23) and its other services (resumed at noon on October 26) to respond to a vulnerability in the PHP programming language announced on October 21. These notices are separate from the Qzoo breach and do not mention Qzoo. When we checked on October 28, the Qzoo site was still showing the breach notice.
What is known and what is not
Status as of October 28, 2026. This table will be updated when follow-up reports are published.
| Item | What was announced | Status |
|---|---|---|
| Unauthorized access occurred | Unauthorized access by a third party confirmed on Oct 17 | Confirmed (company) |
| Number of records in scope | About 400,000 (all records held in the Qzoo system as of Oct 17) | Confirmed (company) |
| Number of people | Announced as records; no number of people given | Not stated |
| Basic information (name, date of birth, address, phone, email, etc.) | The database storing it may have been affected | Possible (company) |
| Member authentication information (member ID, password, etc.) | Same as above | Possible (company) |
| Financial information (account number, branch name, account holder name, etc.) | Same as above | Possible (company) |
| Survey answers (annual income, occupation, attribute data, etc.) | Same as above | Possible (company) |
| Items that actually leaked | Being identified | Under investigation |
| Credit card data, My Number | Not held | Not included (company) |
| How passwords were stored | Not stated | Not stated |
| What the database "update" changed | The timeline says "viewed and updated" but does not say what was changed | Not stated |
| The company's systems other than Qzoo | No unauthorized access found | Not found (company) |
| Cause in outline | Intrusion exploiting a vulnerability in the company's system | Confirmed (company) |
| Details of the cause, recurrence prevention | Being investigated with outside specialists | Under investigation |
| Whether the data has been misused | Not stated | Not stated |
| Service resumption | Will resume once safety is confirmed; outlook to be announced when known | Under investigation |
How to read it: 'possible' and 'records'
The notice says that a database storing four kinds of information may have been affected; which items actually leaked is still being identified. It does not say a leak has been confirmed. The figure of about 400,000 is "all records held", and the notice does not explain how it relates to the number of people, for example duplicate registrations or former members.
What the combination of possibly leaked items could be used for
The following is what the combination of items in scope could generally be used for. The company has not said any of this has happened in this incident.
Email address + password
↓→
The same pair may be tried on other services
→ Change reused passwords / turn on two-step verification for email
Name + account number, branch, holder name
↓→
Fake contacts claiming to be a bank or the police that can quote your registered account
→ Never give PINs, logins or codes / check account activity
Address + date of birth + income, occupation
↓→
Fake identity checks or sales pitches tailored to your situation, including by post or phone
→ Knowing your details does not make a sender genuine
Stated as not included
- Credit card data (not held)
- My Number (not held)
- The company's systems other than Qzoo (no unauthorized access found)
Possibly leaked (under investigation)
- Name, date of birth, address, phone number, email address and more
- Member ID, password and more
- Account number, branch name, account holder name and more
- Survey answers such as annual income and occupation
In a past case at another survey site, infoQ, the "up to" figure in the first report was replaced by a confirmed figure in the second report. That does not mean the same will happen here. This article's table will be rewritten when a follow-up is published.
For those who run services that hold members' bank details
What sets this incident apart is that bank account details, survey answers such as annual income, and login information were all within the scope that may have been affected. In its timeline, the company says the database was viewed and updated through SQL injection. It has not said where the vulnerability was, so the points below are general ones for services of the same type.
Store bank details separately, with separate permissions, from member data
In general, heavy items such as bank details are kept in a separate database from member profiles and survey answers (or in a separate encrypted area), readable only by the payment process. If the account that runs the website's pages can also read bank details, a single flawed entry point exposes everything.
Write every database query without building values into the SQL
SQL injection is the general name for vulnerabilities where input is treated as part of the SQL statement itself (see What is SQL injection?). In general, standardize on placeholders (parameterized queries), and include old pages and admin functions in the inventory.
Make unusual bulk reads and writes detectable
According to the company's notice, about 10 hours passed between the start of the unauthorized access (8:30) and its detection (18:44). In general, logging the number of rows read per request, spikes in errors, and writes to tables that are not normally changed, and alerting staff when thresholds are exceeded, is a practical first step towards shortening the time to notice.
Sources (public record)
The facts in this article come from the public sources below. Undisclosed methods or details of the cause are not speculated on.
- Monitas Inc., apology and notice regarding the possible leak of personal data from unauthorized access to its survey site Qzoo (October 21, 2026, Japanese) — monitas.co.jp
- Qzoo (Monitas Inc.), the same notice for members (dated October 21, 2026; checked October 28, Japanese) — qzoo.jp
- Monitas Inc., notices on its response to a PHP vulnerability (October 23, 25 and 26, 2026; separate from this incident, Japanese) — monitas.co.jp
- Japanese Bankers Association, warning about fake sites and impersonation of its staff (general guidance, Japanese) — zenginkyo.or.jp
- National Police Agency, warning about unauthorized withdrawals from bank accounts via cashless payment services (general guidance, Japanese) — npa.go.jp
Update history
2026-10-28: First version, based on Monitas's notice of October 21. The company says it will announce investigation results, new facts and the outlook for resuming the service as soon as they are known; this article will be updated when they are published.
Read next
- Another survey site incident: the infoQ survey site breach
- Another case where bank account details may have leaked: the Lashinbang breach (ID document numbers and payout bank accounts)
- Passwords: How to check if your password was leaked / Choosing a password manager
- Two-step verification: Getting started with multi-factor authentication
- Follow-on scams: What is phishing?
- For operators: What is SQL injection?
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)