GMO Internet Probes Onamae Breach Affecting 27,000 Servers
GMO Internet probes an Onamae Desktop Cloud breach affecting up to 27,000 servers after hackers demanded $50 million and posted suspected customer data.
Summary
GMO Internet is investigating unauthorized access to Onamae Desktop Cloud, which supplies virtual desktops to financial traders. A suspected attacker posted data apparently linked to customers and GMO’s business, although authenticity and the incident’s full scope remain unverified. Up to 27,000 servers may be affected, and reported unauthorized activity on customer trading accounts prompted password reset advice.
GMO shut Onamae down on October 21 after discovering the intrusion and receiving an approximately 8 billion yen, or $50 million, demand. It notified Japanese police on October 22, promised compensation and alternative service while seeking government help on October 24, collected customer devices for malware analysis on October 25 and 26, and disclosed the suspected data publication on October 27.
About a week earlier, GMO’s cybersecurity unit found the Chinese AI penetration testing tool Artex in attacks against Japanese companies, but no Onamae connection has been established. CrowdStrike linked Artex to September attacks on South Korean financial institutions that exploited weak controls, including absent multi-factor authentication. Artex’s Chinese developer subsequently ended public updates and closed its source. Japan’s Financial Service Agency had urged financial institutions in May to strengthen vulnerability management, layered defenses and incident readiness while using AI and other security tools.
Positives
- GMO notified Japanese police on October 22, one day after shutting the compromised Onamae service.
- GMO promised affected customers compensation and alternative service on October 24 while seeking government assistance.
- Customer devices were collected on October 25 and 26 for malware detection and damage assessment.
- Japan’s Financial Service Agency urged stronger vulnerability management, layered defenses and incident readiness in May.
- Password reset advice followed reports of unauthorized activity on customer trading accounts.
Risks & concerns
- Up to 27,000 servers may be affected by unauthorized access to Onamae Desktop Cloud.
- Hackers demanded about 8 billion yen, or $50 million, after GMO discovered the intrusion on October 21.
- A suspected attacker published information apparently connected to GMO and its customers, but its authenticity remains unverified.
- Customers reported unauthorized operations on trading accounts, creating direct financial risk for Onamae users.
- Artex has targeted Japanese companies and South Korean financial institutions, although no link to the Onamae breach is established.
- Weak controls, including missing multi-factor authentication, enabled the September Artex attacks against South Korean financial institutions.