GMO Internet admits breach of Onamae.com trading cloud

GMO Internet has acknowledged that its Onamae.com Desktop Cloud service was compromised by an attacker. The company admitted that a third party installed malicious programs in the server environments of some customers. As a result, unauthorized operations were performed on some customers' trading accounts. GMO stated that its systems had security vulnerabilities and that customer information was taken outside the company. The company warned that 26,739 VDI servers may have been hit by the attack.

Customers began reporting unrecognized trades on October 21. Broker OANDA Japan confirmed that a third party logged into and traded on some customer accounts using leaked ID and password pairs. GMO shut down the Onamae.com Desktop Cloud servers on every plan starting October 21 after finding malicious programs. On October 24, GMO confirmed unauthorized access to its service and the exfiltration of customer information. The company contacted major trading services to terminate active sessions and block trade requests from Onamae.com. GMO advised users to change passwords using a device not used for trading.

GMO received a demand for about $50 million on October 21 from people believed to be the attackers. The demand threatened to publish information if the payment was refused. GMO refused to pay the extortion demand because complying would not guarantee data deletion or misuse prevention. On October 27, attackers posted material on their website allegedly containing information about GMO and its customers. GMO is offering users a ¥5,000 condolence payment and promised to cover trading losses. The company also offered a $1 million bounty for tips leading to an arrest or international wanted notice regarding the breach.

GMO CEO Masatoshi Kumagai acknowledged that internal white-hat hackers had previously pointed out security improvements needed. The CEO admitted the company's response lacked sufficient depth and speed, allowing attackers to exploit vulnerabilities.