Japanese online services provider GMO Internet is currently probing a significant data compromise, following assertions by attackers that they have publicly released sensitive customer information. This alleged leak stems from an intrusion into the company's Onamae cloud desktop service, which serves financial traders. The full scope of this incident is still under verification by GMO Internet, leading them to urge clients to update their login credentials.
The incident originated on October 21st when GMO Internet deactivated its Onamae Desktop Cloud after detecting unauthorized entry into its systems. Subsequently, the company received a ransom demand from the attackers, approximately 8 billion yen (around $50 million). Promptly, on October 22nd, GMO Internet notified Japanese law enforcement and released an official statement to the public. By October 24th, the company committed to offering restitution and alternative services to its affected customers, seeking assistance from governmental bodies. Over October 25th and 26th, efforts were concentrated on collecting customer devices to analyze for malicious software and to better understand the extent of the damage incurred. The latest development on October 27th saw the company acknowledging that suspected attackers had released information purportedly linked to GMO Internet and its clientele, which the firm is actively trying to confirm.
This breach closely follows a revelation from GMO Internet's cybersecurity division regarding the use of Artex, a Chinese AI-powered penetration testing tool, in attacks against Japanese companies. Although Artex was implicated in previous cyberattacks on financial entities in South Korea during September—highlighting vulnerabilities such as the absence of multi-factor authentication—GMO Internet has not yet established a direct link between Artex and the current compromise of its Onamae service. The developer of Artex has since privatized the tool, discontinuing public updates after its connection to bank attacks surfaced. Japan's Financial Service Agency (FSA) had previously issued guidelines in May, emphasizing the importance for financial institutions to bolster their cybersecurity measures, including improved vulnerability management, layered defenses, and readiness for incidents, while also promoting the adoption of AI and other security technologies.
In response to the developing situation, the company is actively engaged in a thorough investigation to confirm the legitimacy of the posted information and to determine the full impact on its customers. They have advised all affected users to change their passwords immediately to mitigate further risks. With approximately 27,000 servers potentially compromised, the scale of the breach underscores the escalating challenges faced by internet service providers in safeguarding digital assets against sophisticated cyber threats.
