GMO Internet Group held a news conference on Nov 2 over unauthorized access to its Onamae.com Desktop Cloud, a VPS service used for automated FX trading. Questions focused on why the company did not act sooner on a vulnerability its own group company flagged in 2024, and on president Masatoshi Kumagai's posts on social media.
GMO Internet ran four emergency maintenance rounds at the time but never reached a fundamental fix, according to the company. Vice president Hiroshi Yamashita declined to give a specific cause, saying it would be "verified going forward," and said the company had prioritized stable operation of the service and work on other vulnerabilities while "risk analysis was insufficient."
Asked whether cost and business continuity had taken priority in that decision, Kumagai said: "I have never once in 31 years said 'make money' or 'turn a profit.' Customer smiles are the standard."
Warning never reached the top
The 2024 warning was known to president Masashi Ito and Yamashita but was not reported to Kumagai, the company disclosed. Kumagai said he learned of it through the breach.
Reporters asked whether GMO Cybersecurity by Ierae, the group company based in Shibuya, Tokyo, that raised the issue, had enough influence inside the organization. Kumagai acknowledged the problem lay in group power dynamics: "It is difficult to have influence right after joining a group, and influence gradually grows as trust is built internally." He said Ierae's views now carry weight within the group.
On a claim by the suspected attacker that the vulnerability reporting channel was contacted several times and ignored, Kumagai denied it. "No such report reached us," he said, calling the claim "a lie told by the perpetrator to damage our reputation." He stressed that any staff member who had received such a report and left it unanswered would be dismissed.
A call for legislation
Kumagai repeatedly raised the government's role. He said he wanted to explain his "Cyber Aegis" concept to officials in the Takaichi administration "if there is an opportunity." The plan would detect malicious IP addresses used in attacks from abroad and ask telecom carriers to block them promptly. He acknowledged unresolved legal issues including the secrecy of communications, but argued that legislation is needed to improve security.
On his own social media activity, Kumagai said posts suggesting North Korean involvement were his personal view and not the group's official position. Asked about posts including a smiling photo during the incident, which drew complaints that they upset victims, he apologized and said the photo was meant to deter the attacker.
He said he will pause social media posts for a period after a final post summing up the news conference, unless the attacker makes a new move.
Asked whether he would resign to take management responsibility, Kumagai said: "I cannot die leaving the internet contaminated by this malice as it is." He said he would keep working until affected customers are smiling again, but declined to answer directly when a reporter asked whether he would resign once they were.