GMO Internet Group told users of its desktop cloud service for automated FX trading to back up their PCs and turn them off by noon on October 27, after a suspected attacker threatened to release customer data and launch a ransomware attack at that time.
The service, "Onamae.com Desktop Cloud," is a virtual private server run by group company GMO Internet. The company also asked users to run a full virus scan and protect their accounts, and to unplug the power cables from their machines when shutting down.
GMO said it is investigating the extent of the damage, including by analyzing customers' PCs. It began asking users for help with device inspections on October 25 and has been collecting machines from users across the country, sending employees to pick them up.
A white-hat team within the group is analyzing the collected devices one by one to check whether malware such as ransomware has actually been planted. Trend Micro and other AI and security companies have offered to help, and GMO said it is working out what that assistance will involve.
Timeline of the breach
GMO disclosed the unauthorized access on October 21 and shut down servers across all plans. The next day it said login credentials for FX trading accounts may have been obtained and used by a third party. After users reported financial losses one after another, the company announced on October 24 that it would pay ¥5,000 in compensation and cover losses from fraudulent trades.
The attacker has also made monetary demands. Representative Masatoshi Kumagai said on October 26 that a demand for $50 million (about ¥8 billion) had been made with a deadline of 5 p.m. on October 21. A suspected attacker then demanded $1 million (about ¥16 million) by noon on October 27, threatening to release customer data and carry out a ransomware attack if the demand was not met.
GMO said it will not pay, and is working with police and other authorities.