Japan internet giant GMO says hackers posted stolen customer data

Japanese internet company GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae cloud desktop service, which provides virtualized desktops to financial traders

The IT and internet services giant said on its blog that it believes the attacker has published information allegedly linked to customers and its business. However, the contents are still being verified and the full extent of the incident remains unclear.

GMO Internet has since advised customers to reset their passwords, amid receiving reports of “unauthorized operations” performed on customer trading accounts. The company said 27,000 servers may be affected by the breach.

A spokesperson for GMO Internet did not respond to TechCrunch’s request for comment.

The incident comes about a week after the Japanese firm’s cybersecurity unit separately reported finding evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan. However, the company said it has not publicly established a connection between Artex and the breach of Onamae.

The Artex tool was also used to hack financial institutions in South Korea in September, according to a report by CrowdStrike earlier this month. The attacks largely relied on exploiting weak security controls, such as a lack of multi-factor authentication. Artex’s Chinese developer has since stopped public updates and made the AI security tool closed-source after it was linked to cyberattacks targeting banks, per Reuters.

A spokesperson at Japan’s Financial Service Agency (FSA) told TechCrunch that it issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities.

The regulator called for stronger basic defenses, including “vulnerability management, defense-in-depth and incident preparedness,” while encouraging firms to use AI and other security tools, the spokesperson added.

Here’s the timeline of the Onamae breach.

Oct 21: GMO Internet shut down its Onamae Desktop Cloud service after discovering unauthorized access had occurred to its systems without permission. The IT firm also received an email from hackers demanding about 8 billion yen (~$50 million).

Oct 22: The Japanese company reported the incident to Japanese police and shared another public update.

Oct 24: GMO Internet said it would offer customers compensation and alternative service while seeking help from government agencies.

Oct 25-26: The company began collecting devices from customers to detect malware and better understand the damage.

Oct 27: The Japanese IT firm said a suspected attacker had posted information that appeared to be linked to the company and its customers. GMO said it was still checking whether the information was genuine.