2026-11-15
Unauthorized access to GFS Education's GFS member site (about 110,000 people, My Number Card back images for 84): ID document images and password-related data leaked or may have leaked — what affected people should do
On November 13, 2026, GFS Education Inc. announced that a third party had gained unauthorized access to the GFS member site it operates, and that some personal information and information containing individual numbers (My Number) has leaked or may have leaked. The company detected an abnormal server load on November 9, investigated, and found the access. The personal information covers about 110,000 people (members, former members, applicants and people who sent inquiries) and includes name, email address, date of birth, password-related information (values protected when stored), phone number, address, viewing and purchase history, inquiry content, submitted homework images and images of ID documents. For 84 of them, the data includes the back of the My Number Card (which shows the 12-digit individual number). The company stores credit card numbers partly masked and says leakage of full card numbers has not been confirmed. The cause was the exploitation of a program flaw in the image upload feature, which let an attacker place and run a malicious program, together with a flaw in the server's access permission settings. As of November 15, 2026, no follow-up has been found. Our conclusion: change your password, and if your ID document images or the back of your My Number Card are involved, watch for notices of contracts you did not make and for contact that pretends to be the company or a public agency.