Incident Overview
Japanese internet company GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae cloud desktop service, which provides virtualized desktops to financial traders.
The IT and internet services giant stated that it believes an attacker has published information allegedly linked to customers and its business, though the contents are still being verified and the full extent of the incident remains unclear.
GMO Internet has advised customers to reset their passwords amid receiving reports of unauthorized operations performed on customer trading accounts, noting that 27,000 servers may be affected by the breach.
A spokesperson for GMO Internet did not respond to TechCrunch’s request for comment.
Broader Security Context
The incident comes about a week after the firm’s cybersecurity unit reported finding evidence that an AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan, though no direct public connection has been established between Artex and the Onamae breach.
The Artex tool was also linked to attacks on financial institutions in South Korea relying on weak security controls, prompting its Chinese developer to stop public updates and make the software closed-source.
Japan’s Financial Service Agency previously issued guidance urging financial institutions to prepare for rising cybersecurity vulnerabilities.
The regulator called for stronger basic defenses, including vulnerability management and incident preparedness, while encouraging firms to utilize AI and other security tools.
Timeline of Events
Here is the timeline of the Onamae breach.
October 21: GMO Internet shut down its Onamae Desktop Cloud service after discovering unauthorized access had occurred to its systems without permission. The IT firm also received an email from hackers demanding about 8 billion yen.
October 22: The company reported the incident to Japanese police and issued a public update.
October 24: GMO Internet announced plans to offer customers compensation and alternative services while seeking assistance from government agencies.
October 25-26: The company began collecting devices from customers to detect malware and assess the extent of the damage.
October 27: The firm stated that a suspected attacker posted information appearing to be linked to the company and its customers, while verification efforts continued.
