Hackers post data allegedly stolen from Japanese web giant GMO

GMO Internet, a large Japanese internet company, says a suspected hacker has posted information that appears linked to its customers and its business. The posting follows a break-in at Onamae Desktop Cloud, a service that gives financial traders a virtual computer they use over the internet. GMO is still checking whether the posted data is real.

What happened

On Oct. 21, GMO shut down the service after finding that someone had gotten into its systems without permission. The company also received an email from hackers demanding about 8 billion yen, roughly $50 million. It reported the incident to Japanese police on Oct. 22.

On Oct. 24, GMO said it would offer customers compensation and an alternative service, and that it was seeking help from government agencies. On Oct. 25 and 26, it began collecting devices from customers to look for malicious software and to understand the damage.

Why it matters

GMO says it has received reports of "unauthorized operations" on customer trading accounts. That means some customers may have seen activity they did not do themselves. The company also said up to 27,000 servers may be affected. The full size of the incident is still unclear.

There is a wider backdrop. About a week earlier, GMO's cybersecurity unit reported evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks on companies across Japan. Such tools are meant to help security teams probe for weak spots. GMO has not publicly linked Artex to the Onamae breach.

CrowdStrike reported that Artex was also used against South Korean financial institutions in September. Those attacks mostly relied on weak security, such as a lack of multi-factor authentication, which is the extra code you enter when you sign in.

Who can relax

The reports so far concern the Onamae cloud desktop service. If you have never used it, nothing in the available information says you are affected. Customers of the service, especially anyone who trades through it, should treat this as urgent.

What to do

The alert above lists the steps. The short version: change your password, check your accounts, and add the extra sign-in code. Be careful with any email that claims to come from GMO, since scammers often use news like this as cover.

What happens next

GMO is still verifying the posted data, and it did not respond to TechCrunch's request for comment. Japan's Financial Services Agency told TechCrunch it issued guidance in May urging financial firms to prepare for more security weaknesses. Updates are expected on GMO's official blog.