GMO Internet Group said on October 27 that it has confirmed the attackers behind the breach of its FX trading VPS service are collecting information on people who visit the site where they publish stolen data. The company urged users not to access the material and said it cannot take responsibility for harm that results from doing so.
The service, "Onamae.com Desktop Cloud," is a virtual private server product used to run automated foreign-exchange trading programs. GMO Internet Group said it had confirmed the attackers' publication of information at 12:30 p.m. that day and is working with police and other authorities.
Scan and stay away
GMO asked anyone who has already visited the site to run a full scan of their PC with antivirus software. It also asked users not to repost the material, share it on social media or pass on links that lead to it, saying such activity infringes on customers' privacy and risks expanding secondary harm such as fraud and identity misuse.
For people who spread the material in a particularly malicious way, GMO said it is securing evidence and preparing legal measures, including disclosure requests to identify posters and criminal complaints or accusations.
Phishing and press caution
The company warned of phishing emails and scams capitalizing on the incident. GMO said it never asks for passwords or authentication codes, and told users not to respond to messages demanding payment with claims such as recovering lost funds. It also asked news organizations to refrain from excessive coverage that could lead to further harm to customers.
GMO had earlier urged VPS users to back up their PCs and switch them off after the attackers gave notice of an attack on customers' computers at noon on October 27. The company has said it is collecting affected terminals and that its in-house white-hat hackers are analyzing them.