The breach at GMO Internet Group entered a new phase on October 27, when a statement said to be from the attackers and data said to be user information were published online. The company has not confirmed whether the data includes customer records, and says it is investigating.
The intrusion at the internet services group has gone beyond stolen files. Unauthorized account transactions have been reported, and the attackers have threatened to keep them going and to attack customers' PCs. Restoring systems from backups does not stop leaked information from being published or misused.
The method is a form of double extortion: malicious software is planted, data is encrypted and locked, and the stolen information is held as a further threat. The GMO case adds a third lever, with customers themselves named as targets.
AI on both sides of the fight
Eva Chen, CEO of security firm Trend Micro, warned at a press conference in Tokyo on the 19th that stolen personal data is only the start of further attacks. Information sold to other criminal groups can feed fraud and break-ins at other companies, she said.
AI may speed that chain. Chen said she could not confirm whether AI was used in the GMO attack, but pointed to its use in analyzing leaked data and automating attacks. Scam emails once given away by unnatural Japanese can now be written fluently, she said.
“The so-called 'wall of Japanese' has disappeared because of AI.”Eva Chen, CEO of Trend Micro
Defenders are using AI too. Trend Micro says it applies AI to spot attacks early and decide how to respond, putting the contest on an AI-versus-AI footing, where speed before damage spreads is what counts.
A request to the government
Governments have moved against attackers directly. In 2024, British and US authorities took control of systems used by the LockBit criminal group.
In Japan, provisions took effect in October allowing police to access attack servers and stop or delete malicious programs, part of active cyber defense — a policy of neutralizing attackers' systems rather than only blocking them. On the 24th, GMO said it had asked the government for an emergency application of the measure.
Japan's framework differs from those of the US and UK. Police may act only where there is an urgent need to prevent serious harm to life or property, and prior approval from an independent body is required in principle.
Government action does not take over a company's own security duties. Companies are expected to fix vulnerabilities, strengthen authentication and monitor with AI, and to work with business partners and authorities so that protecting customers after a leak is part of the plan.