GMO Internet Group and GMO Internet held a press conference in Tokyo on November 2 on unauthorized access to Onamae.com Desktop Cloud, a server service built for automated foreign-exchange trading. Customer data affected totals 26,739 records, and one record has been posted on a criminal site. The intruders demanded ¥8 billion in ransom, which the company refused to pay.
"In 31 years I have never once used the word 'profit,'" said Masatoshi Kumagai, group representative director and chairman of GMO Internet Group, repeating the line several times. He said he had kept telling staff to protect information for customers.
The group has made security a management pillar since 2022. The breach came to light through a customer inquiry, not through the company's own monitoring.
Two and a half months without detection
The attacker entered a customer environment, a virtual private server, on August 5 and stole an administrator account. The attacker then entered a management server on August 17 and distributed malware to customer VPS environments between September 20 and October 14.
GMO Internet began investigating on October 20 after customers contacted it. The intrusion went undetected for about two and a half months.
Some reports said GMO Cyber Security by Ierae, a group company, had identified and reported the vulnerability in 2024. Kumagai acknowledged at the press conference that this was true.
After the warning, GMO Internet ran four rounds of emergency maintenance between April and May of that year. Hiroshi Yamashita, vice president and executive officer, admitted the response fell short, saying it was "insufficient in both depth and speed."
Ierae's warning was never escalated to Kumagai, the group's top executive. Tomoki Kawasaki, the group's general manager of legal affairs, said no clear standard existed for deciding which vulnerabilities should go to the board.
Questions turn to structure and social media
Reporters pressed on the organizational setup and on Kumagai's posts on social media, which drew criticism as the company tried to contain the incident.
On October 27 the group told users of Onamae.com Desktop Cloud to take a backup, disconnect from the network, power down and unplug cables connected to their PCs by noon that day, citing the ransomware attack.
The group has also set up a "GMO Cybercrime Eradication Reward" worth up to $1 million in total, about ¥150 million, and will pay special condolence money of up to ¥3 million.