GMO Internet Group said on October 27 that it is considering compensation for customers whose information appears to have been published by attackers behind the unauthorized access to its foreign exchange, or FX, services. The group also said it will provide a new PC to any customer who suffers a ransomware attack.
The breach centers on "Onamae.com Desktop Cloud," a virtual private server the group operates for automated FX trading. GMO Internet Group said on October 24 that an attacker had demanded money and threatened to misuse customers' brokerage accounts, publish personal information, run a ransomware attack and release internal material on its systems and operations if it did not comply.
On October 26 the group said the attacker had given notice of plans to publish customer personal information and launch a ransomware attack at noon the following day. It said it would not meet the demands and told customers to switch off their PCs.
By the afternoon of October 27 no ransomware attack had been confirmed, but information believed to relate to customers had been published. Material presented as customers' data has been circulating on social media, with its authenticity unconfirmed.
Payments and replacements
GMO Internet Group has already decided to pay every service user 5,000 yen. The compensation now under consideration is an additional measure for customers who confirm that their own information is among what was published.
For customers hit by a ransomware attack, the group said it would "confirm the circumstances of the damage and provide a new PC with performance equivalent to the PC that suffered the damage."
The group also announced compensation for realized losses from unauthorized trades carried out through the breach, and guidance on alternative services with six months of free use.
A warning against sharing
GMO Internet Group asked customers not to limit the spread of the material, saying: "Even if you see what appears to be a customer's information on the internet, please strictly refrain from reproducing it, reposting it on social media, or sharing links that lead to that information." The group said it intends to take legal action against people who spread the information in particularly malicious cases.