GMO Internet Group said on October 27 that it confirmed at 12:30 p.m. that day that a person believed to be the attacker had published what appeared to be information about customers, in connection with unauthorized access to the "Onamae.com Desktop Cloud" VPS service for automated FX trading run by its subsidiary GMO Internet.
The attacker had said a ransomware attack would be carried out at noon that day and that customer information would be released. GMO said it is still investigating what was published and that the material may contain information that is not true.
As of 1:55 p.m., the threatened ransomware attack had not been confirmed, the company said. GMO said it remains on alert and is continuing to investigate the extent of the damage by analyzing users' PCs.
Second payment under consideration
If the published information contains personal data, GMO will contact the people concerned individually. For users whose information is confirmed to have been published, the company is considering an additional payment on top of the flat ¥5,000 it announced on October 24. The amount has not been decided.
GMO Internet Group also asked people not to visit the site where the information was posted or to spread the published material. "Information on people who access the site is being obtained by the attacker," the company said.
To prevent secondary harm, GMO said it is preparing legal measures including civil disclosure requests and criminal complaints against people who spread the information in particularly malicious ways.
Ransom demands escalated
GMO disclosed the unauthorized access on October 21 and shut down servers across all plans that day. After a run of reports from users of financial losses, it announced on October 24 that it would pay users ¥5,000 and compensate losses from fraudulent transactions.
The attacker has demanded money. According to an account by representative Masatoshi Kumagai on his blog on October 26, the initial demand was $50 million (about ¥8 billion) by 5 p.m. on October 21. The person believed to be the attacker later changed the demand, warning that customer information would be published and a ransomware attack carried out unless $1 million (about ¥160 million) was paid by noon on October 27. GMO had said it would not comply with the demand for money.