A website the attacker used to post threats against GMO Internet over a breach of its foreign-exchange trading services can no longer be reached through the URL that spread online, it emerged on the 28th. The domain name used to connect to the site appears to have been suspended.
GMO Internet Group said the same day that it had "confirmed that the domain of the perpetrator's site has been suspended." A domain name is the address a site uses on the internet.
A search of registration records through ICANN, the nonprofit that coordinates domain names worldwide, showed a record indicating the registrar had suspended the domain. A second domain the attacker presented as a mirror site was in the same state.
The extortion site appears to have used a service run by an overseas rental server operator, which also handles domain registration. The Asahi Shimbun has asked the operator for the details and reasons behind the suspension.
Personal data posted before takedown
According to security officials, the site carried names, addresses and other details described as "customers' personal information" on the 27th. The attacker had warned that more personal information would be released the same way.
On X, formerly Twitter, a user posted that they had reported the site to the operator as a violation of its terms. The operator replied, "Thank you. We will contact you once we have completed our response," according to the post.
The attacker may set up another site. GMO said on the 28th that "if a similar site is newly opened in the future, we will move immediately to take it down as soon as we confirm it," and asked people to refrain from accessing the attacker's sites or spreading their contents.