GMO Internet Investigates Breach at Onamae Cloud Desktop Service
GMO Internet is investigating a data leak at its Onamae cloud desktop service after a suspected attacker posted customer information; 27,000 servers may be affected.
The story in focus
GMO Internet is investigating a data leak after unauthorized access to its Onamae cloud desktop service. The company said a suspected attacker posted information allegedly linked to customers and its business, and that 27,000 servers may be affected. It advised password resets; the authenticity of the leaked data is still being verified.
- GMO Internet is investigating a data leak at its Onamae cloud desktop service.
- The company believes an attacker published information allegedly linked to customers and its business.
- GMO said 27,000 servers may be affected by the breach.
- The company advised customers to reset passwords after reports of unauthorized operations on trading accounts.
- GMO shut down Onamae on October 21 after detecting unauthorized access and receiving a demand of about 8 billion yen.
Breach and suspected data leak
GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae cloud desktop service, which provides virtualized desktops to financial traders. The company said on its blog that it believes the attacker has published information allegedly linked to customers and its business, but the contents are still being verified and the full extent of the incident remains unclear.
GMO said 27,000 servers may be affected. It advised customers to reset their passwords after receiving reports of unauthorized operations on customer trading accounts. A spokesperson for GMO Internet did not respond to TechCrunch's request for comment.
Timeline and response
On October 21, GMO shut down Onamae after discovering unauthorized access and received an email from hackers demanding about 8 billion yen (about $50 million). The company reported the incident to Japanese police on October 22 and said on October 24 it would offer customers compensation and alternative service while seeking help from government agencies.
Between October 25 and 26, GMO began collecting devices from customers to detect malware and better understand the damage. On October 27, it said a suspected attacker had posted information that appeared linked to the company and its customers, and that it was still checking whether the information was genuine.
Context and regulatory guidance
The incident comes about a week after GMO's cybersecurity unit separately reported evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan. GMO said it has not publicly established a connection between Artex and the Onamae breach.
Japan's Financial Services Agency told TechCrunch it issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities, calling for stronger vulnerability management, defense-in-depth and incident preparedness.
What did GMO Internet say about the suspected attacker and the affected servers?
GMO said a suspected attacker published information allegedly linked to customers and its business, and that it is verifying whether the data is genuine. The company said 27,000 servers may be affected.
Sources & further reading
Help keep the record accurate. Send a correction.
