Security Breach Details
GMO Internet, a Japanese company specializing in internet services, announced that its "Onamae Desktop Cloud" service has suffered a large-scale security breach, resulting in unauthorized access to the company's systems. This service provides virtual desktop machines primarily used by financial traders.
The company confirmed that the attackers published information allegedly linked to its customers and business operations, while the company is still in the process of verifying the authenticity of this data and the actual extent of the damage. Initial estimates indicate that the breach may affect up to 27,000 servers.
Incident Developments and Attacker Demands
The crisis began on October 21 when the company shut down the service immediately upon discovering the unauthorized access. At the same time, it received an email from the attackers demanding a ransom of 8 billion Japanese yen (approximately 50 million dollars). The company has taken a series of response measures, including:
- Reporting the incident to Japanese security authorities.
- Providing compensation to customers and offering alternative services.
- Cooperating with government agencies to investigate the breach.
- Initiating scans of customer devices to detect any malicious software.
What This Means for Users
Users of the service, especially financial traders, are facing direct security risks, as the company has received reports of "unauthorized operations" carried out on customers' trading accounts. The company has advised all its users to reset their passwords immediately as a precautionary measure.
Security Context and Cyber Threats
This breach comes at a time when Japan is witnessing increasing warnings about cyberattacks. The cybersecurity unit of GMO previously pointed to evidence of the use of a Chinese AI-powered penetration testing tool known as "Artex" in attacks targeting Japanese companies. However, the company has not officially confirmed a direct link between the Artex tool and this specific breach.
For its part, the Japan Financial Services Agency (FSA) has issued directives to financial institutions to strengthen their core defenses, including vulnerability management, multi-layered defense, and incident response preparedness, while encouraging the use of advanced security tools to counter escalating threats.