Japan’s GMO Internet is investigating an intrusion into its Onamae.com Desktop Cloud service that may have affected 26,739 customer servers, exposed information stored in those environments and led to unauthorized activity in some trading accounts.
The company has suspended the service, notified police and regulators, and said it will compensate verified losses linked to unauthorized transactions. Attackers later published material they claimed came from GMO and its customers after demanding about JPY 8 billion ($52 million), according to the company’s October 27 incident update.
Intrusion prompted a full service shutdown
GMO said it began investigating after receiving a customer inquiry on October 19. The following day, it confirmed that a third party had installed malicious programs in some customer server environments. On October 21, the company began shutting down servers across all Onamae.com Desktop Cloud plans to contain the incident.
The cloud service provides virtual desktop environments used by customers including foreign-exchange traders running tools such as MetaTrader. GMO warned that credentials stored in the affected environments may have been viewed and asked customers to change passwords from unaffected devices, review transaction histories and enable multifactor authentication where available.
In an October 24 disclosure, GMO said its investigation had confirmed security vulnerabilities, unauthorized access and the transfer of customer information outside the company. It also said some customers reported transactions they did not recognize. Payment-card information was stored separately and was not held on the affected service, according to the company.
Attackers posted data after ransom demand
GMO said it received an email demanding approximately JPY 8 billion and threatening to publish company and customer information, interfere with trading accounts and carry out ransomware attacks. The company said it would not pay because payment would not guarantee deletion of the data or prevent misuse.
On October 27, GMO confirmed that people believed to be responsible for the attack had published information they claimed was connected to the company and its customers. GMO said it was still checking the authenticity and scope of the material and warned customers and the public not to access or redistribute it because the attackers could collect visitor information and further expose affected users.
Reuters reported that the incident was among several recent cyberattacks disrupting Japanese companies and raising concerns about the financial and operational effects of breaches. GMO’s shares fell sharply after it announced the compensation plan, according to the report.
Compensation and investigation continue
GMO plans to pay JPY 5,000 to every current customer of the affected service as a goodwill payment. It also said it will compensate realized trading losses that its investigation confirms resulted from unauthorized transactions, after taking account of any refunds issued by brokers or exchanges.
The company is working with an external cybersecurity firm, police, government agencies, securities companies and foreign-exchange brokers. It has asked trading providers to block access from the compromised environment, terminate active sessions and monitor for suspicious activity. A temporary alternative service will also be offered to customers while Onamae.com Desktop Cloud remains unavailable.
On October 28, GMO opened an information-reward program with a total cap of $1 million, or about JPY 150 million, for credible information that helps identify and arrest those involved. The company said 113 submissions arrived within the program’s first six hours.
GMO said its analysis of customer devices collected for examination had not found traces of malware or ransomware as of its latest update. That finding does not close the investigation: the company is still assessing the intrusion route, the full scope of information removed and the damage associated with unauthorized account activity.
Proofpoint details disruption of phishing-kit network targeting Japanese users