GMO Internet Says Suspected Hackers Posted Customer Data

Japan’s GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae Desktop Cloud service, which provides virtual desktops to financial traders. The company says a suspected attacker posted information that appeared to be linked to GMO and its customers, but it is still checking whether the data is genuine. The full extent of the incident remains unclear.

GMO said 27,000 servers may be affected. It has advised customers to reset their passwords after receiving reports of unauthorized operations on customer trading accounts. A GMO spokesperson did not respond to TechCrunch’s request for comment.

GMO shut down the service on Oct. 21 after discovering unauthorized access. The company said it received an email demanding about 8 billion yen, or approximately $50 million. It reported the incident to Japanese police on Oct. 22 and said on Oct. 24 that it would offer customers compensation and alternative service. From Oct. 25 to 26, it began collecting customer devices to check for malware and assess the damage. On Oct. 27, it reported that a suspected attacker had posted information apparently linked to the company and its customers.

GMO has not publicly established a connection between the breach and Artex, a Chinese AI-enabled penetration-testing tool that its cybersecurity unit separately linked to attacks targeting companies in Japan. CrowdStrike reported earlier this month that Artex was also used in September attacks on financial institutions in South Korea.