GMO Internet Group held a press conference on November 2, 2026, to explain and apologize for unauthorized access to the "Onamae.com Desktop Cloud" service run by group company GMO Internet. Two other group companies have also disclosed security incidents, and one of them went unmentioned at the briefing.
GMO GlobalSign and GMO Payment Gateway have both reported unauthorized access cases. The GlobalSign case came up only after reporters asked about it. The Payment Gateway case, published the same day as the briefing, was not raised at all.
Asked why, GMO Internet Group said each group company issues its own notices. "The November 2 press conference was held to explain the background, our response to customers and our future efforts regarding the unauthorized access to Onamae.com Desktop Cloud," the company said. "Incidents at group companies are announced by each company."
Nine years of exposed settings
GMO GlobalSign said on October 30 that a configuration error had left customer information viewable from outside for about nine years, from November 2017, in its single sign-on service GMO Trust Login. The service covers 2,492 companies and 45,030 people, and the company said it had confirmed that third parties obtained the information.
At the November 2 briefing, president Masatoshi Kumagai said the Trust Login case was "a matter that should have raised an alert" and that the company would investigate why it was not resolved. A responsible official from GMO GlobalSign also described how the incident unfolded. The company is working toward countermeasures by November 30.
GMO Payment Gateway said on November 2 that "acts by a malicious user" had occurred in a payment support service it provides to Life Card, and that some customer information may have been stolen. Names, email addresses, phone numbers and numbers for Life Card's prepaid V Preca card may have leaked, affecting 69 cases in total.
Monthly reports promised
GMO Internet Group said it would report on the implementation of measures to prevent a repeat of the Trust Login incident every month until all countermeasures are complete, with the first report planned for November 30. On the Payment Gateway incident, it said the company would promptly announce anything that should be disclosed if new facts emerge.
On the run of incidents across its subsidiaries, the group said it takes seriously the trouble and concern caused to customers and those involved. It said it is now carrying out a full inspection of services across the group and checking whether its past efforts were effective, and will announce how it will proceed with the review and prevention measures once it has decided on the best approach.
“"Properly close the buttons,"”Masatoshi Kumagai, GMO Internet Group president, addressing a group company official at the briefing
At the same briefing, Kumagai told a group company official, "You are apologizing," in a remark that drew attention.