Japan's GMO Internet breach: 27,000 servers hit

Japanese internet company GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae cloud desktop service, which provides virtualized desktops to financial traders TechCrunch. The company said it believes the attacker has published information allegedly linked to customers and its business, though the full extent remains unclear TechCrunch. This service acts as a remote workspace, allowing users to access their desktop environment from different devices, which means the data stored there is often highly sensitive BleepingComputer.

GMO Internet advised customers to reset their passwords after receiving reports of unauthorized operations on trading accounts TechCrunch. The company stated that 27,000 servers may be affected by the breach, a scale that suggests a significant portion of its user base was potentially exposed TechCrunch. A spokesperson for GMO Internet did not respond to requests for comment, leaving many details to be verified by the company itself TechCrunch.

The incident began on October 21 when GMO shut down the Onamae Desktop Cloud service after discovering unauthorized access TechCrunch. The company also received an email from hackers demanding about 8 billion yen, roughly $50 million TechCrunch. GMO reported the incident to Japanese police the next day and has since offered customers compensation and alternative service while seeking help from government agencies TechCrunch.

The breach primarily affects users of the Onamae Desktop Cloud, a popular VPS provider in Japan operated by GMO Internet BleepingComputer. The company announced it detected an intrusion on October 20 that could have installed malware on up to 26,739 customers' servers BleepingComputer. To minimize risk, GMO shut down the servers and reduced service availability before launching a full investigation BleepingComputer.

GMO assured customers that their payment information had not been exposed, which is a significant relief for those worried about direct financial theft BleepingComputer. However, the company warned that MetaTrader 4 and MetaTrader 5 credentials and trading-account details may have been exposed or compromised BleepingComputer. This means users who trade stocks or currencies through these platforms are at risk of account takeover if they did not change their passwords immediately BleepingComputer.

The company urged customers to reset their passwords and terminate active sessions to secure their accounts BleepingComputer. On October 26, GMO warned that threat actors planned to leak customer information online and trigger a ransomware payload planted on customer servers BleepingComputer. The next day, the company asked customers to disconnect their PCs from the internet, shut them down, and unplug all cables before noon BleepingComputer.

If you use Onamae Desktop Cloud, the immediate risk is not just a data leak, but the potential for unauthorized access to your trading accounts BleepingComputer. The attackers threatened to launch a ransomware attack, which would lock your files and demand payment for their release BleepingComputer. Fortunately, it appears the attacker never acted on their threat, as no ransomware was activated on customer machines BleepingComputer.

GMO said it would not pay the ransom and instead announced it would compensate each customer 5,000 yen, about $30, for the inconvenience caused BleepingComputer. For customers whose information was exposed, the company said it will consider additional financial compensation BleepingComputer. The company is working with Trend Micro to recover from the cyberattack and is scanning customer systems to determine whether malware is still present BleepingComputer.

This incident highlights the importance of multi-factor authentication, especially for financial accounts TechCrunch. The attacks largely relied on exploiting weak security controls, such as a lack of multi-factor authentication, according to reports on similar tools TechCrunch. Japan’s Financial Service Agency issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities TechCrunch. The regulator called for stronger basic defenses, including vulnerability management and incident preparedness TechCrunch.

The incident comes about a week after GMO’s cybersecurity unit reported finding evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan TechCrunch. However, the company said it has not publicly established a connection between Artex and the breach of Onamae TechCrunch. The Artex tool was also used to hack financial institutions in South Korea in September, according to a report by CrowdStrike TechCrunch.

Artex’s Chinese developer has since stopped public updates and made the AI security tool closed-source after it was linked to cyberattacks targeting banks TechCrunch. This shift suggests that the tool was being used for offensive purposes rather than just defensive testing TechCrunch. The use of AI in cyberattacks is a growing trend, and it makes it harder for defenders to keep up TechCrunch.

GMO warned people and the media not to disseminate the exposed information, announcing it will take legal action against those who do BleepingComputer. The company reaffirmed its refusal to pay the attackers, a stance that is generally recommended by security experts BleepingComputer. Paying ransoms does not guarantee data deletion and can encourage further attacks BleepingComputer.

• Quest Diagnostics confirmed a cyberattack affecting patient health and medical records stored in its Quanum system TechCrunch.
• Warp disclosed a breach exposing AI agent logs and user telemetry data after an attack on a third-party vendor in its infrastructure BleepingComputer.
• UNM Health disclosed a cyberattack that caused system outages, disrupted patient care, and led to the suspension of outpatient surgeries BleepingComputer.

If you use Onamae Desktop Cloud or any cloud-based trading platform, reset your passwords immediately and enable multi-factor authentication if it is available BleepingComputer. 1. Log in to your account and change your password to a strong, unique one.

1. Check if multi-factor authentication is enabled and turn it on if it is not.
2. Review recent account activity for any unauthorized transactions or logins BleepingComputer.