ID documents
2 articles with this tag
Unauthorized access to GFS Education's GFS member site (about 110,000 people, My Number Card back images for 84): ID document images and password-related data leaked or may have leaked — what affected people should do
On November 13, 2026, GFS Education Inc. announced that a third party had gained unauthorized access to the GFS member site it operates, and that some personal information and information containing individual numbers (My Number) has leaked or may have leaked. The company detected an abnormal server load on November 9, investigated, and found the access. The personal information covers about 110,000 people (members, former members, applicants and people who sent inquiries) and includes name, email address, date of birth, password-related information (values protected when stored), phone number, address, viewing and purchase history, inquiry content, submitted homework images and images of ID documents. For 84 of them, the data includes the back of the My Number Card (which shows the 12-digit individual number). The company stores credit card numbers partly masked and says leakage of full card numbers has not been confirmed. The cause was the exploitation of a program flaw in the image upload feature, which let an attacker place and run a malicious program, together with a flaw in the server's access permission settings. As of November 15, 2026, no follow-up has been found. Our conclusion: change your password, and if your ID document images or the back of your My Number Card are involved, watch for notices of contracts you did not make and for contact that pretends to be the company or a public agency.
Unauthorized access to Monex Securities' account-opening system (up to 1.13 million email addresses, 1,592 ID document images): what may have leaked and what to do today
On November 13, 2026, Monex Securities announced that unauthorized access to part of its account-opening systems, which are run and managed by an outsourced contractor, may have leaked personal information. The contractor detected an attempted unauthorized access on October 18 and cut off external access on October 19 (account opening is currently partly suspended). An interim report from an external forensic firm named, as confirmed so far, two kinds of data: up to 1.13 million email addresses (registered in the first step of online account-opening applications since October 16, 2019) and 1,592 ID document image files (the front of My Number cards, the front and back of driver's licenses, and selfie images). Account numbers, login passwords and trading passwords are not in the same database, and the company says it has confirmed they have not leaked as of now. No leak of the My Number or the back of the My Number card has been confirmed. The investigation continues, and the figures may change after further review. No unauthorized trading or impact on assets has been confirmed. The cause is under investigation. Our conclusion: if your email address may be affected, do not open links in email or SMS that claim to be from Monex Securities; if images of your ID documents may be affected, watch your accounts for impersonation attempts.