GMO Internet Group, which has promoted itself as home to the world's strongest white-hat hackers, has disclosed that an intruder planted malware on up to 26,739 customer servers used for automated foreign-exchange trading, and that its own security subsidiary had flagged the vulnerability behind the breach.
The company took about two and a half months to notice the intrusion, confirming the damage on October 20 after customers raised it. The breach was explained at a news conference on November 2.
According to the account given at the conference, the attacker entered a customer server on August 5. The attacker then used a stolen administrator account to reach GMO's management servers.
From there the intruder pushed malware to as many as 26,739 customer servers, causing losses on FX trades and extracting customer data. GMO's FX service is used for automated trading, where software places orders on customers' behalf.
A warning from inside the group
About two and a half years earlier, in April 2024, GMO Cyber Security by Ierae — the group's own security specialist firm — had pointed to a vulnerability in the system. GMO ran emergency maintenance four times between April and May that year and still did not prevent the damage.
At the conference, reporters pressed on why the warning did not stop the breach. President Masatoshi Kumagai said no report had reached him at the time.
Asked about his subordinates' handling, Kumagai first said the group's standard was customers' smiles. "I believe the people on the ground judged that this would please our customers," he said.
When reporters pressed him on the vague answer, he shifted: "We have not yet been able to verify why that judgment was made."
Vice President Hiroshi Yamashita, who had received the report, said only that the response had been lacking in both depth and speed. "We will verify going forward what was lacking," he said.
Yamashita refused to disclose what Ierae had found, citing the risk of recurrence. On November 7, NHK reported the specifics.
Ierae had warned that the Active Directory function used to manage authentication allowed administrators to reach all users' information, NHK reported. A breach would put all of that data at risk, and the firm called for administrator privileges to be restricted.
In the end, administrator privileges were seized and customer information was stolen, NHK reported.
At the November 2 conference, Yamashita described how the group had made security a management pillar since 2022. "We take it extremely seriously that this happened despite these measures," he said at the close.