GMO Internet Investigating Onamae Breach After Hackers Post Alleged Customer Data

GMO said on its blog that it believes the attacker has published information allegedly tied to customers and its business, but the contents are still being verified and the full extent of the incident remains unclear. A GMO spokesperson did not respond to TechCrunch's request for comment.

The breach became visible on Oct. 21, when GMO shut down Onamae Desktop Cloud after discovering unauthorized access to its systems. The company also received an email from hackers demanding about 8 billion yen, or roughly $50 million. GMO reported the incident to Japanese police on Oct. 22 and issued another public update.

On Oct. 24, GMO said it would offer customers compensation and alternative service while seeking help from government agencies. Between Oct. 25 and Oct. 26, it began collecting devices from customers to detect malware and better understand the damage. On Oct. 27, GMO said a suspected attacker had posted information that appeared to be linked to the company and its customers, and that it was still checking whether the material was genuine.

The Onamae service provides virtualized desktops to financial traders. GMO's warning to reset passwords followed reports of unauthorized operations on customer trading accounts, according to the company's blog.

The incident comes about a week after GMO's cybersecurity unit separately reported finding evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan. GMO said it has not publicly established a connection between Artex and the Onamae breach.

CrowdStrike reported earlier this month that Artex was also used to hack financial institutions in South Korea in September, with the attacks largely relying on weak security controls such as a lack of multi-factor authentication. Reuters reported that Artex's Chinese developer has stopped public updates and made the AI security tool closed-source after it was linked to cyberattacks targeting banks.

A spokesperson at Japan's Financial Services Agency told TechCrunch that the regulator issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities. The FSA called for stronger basic defenses, including vulnerability management, defense-in-depth and incident preparedness, and encouraged firms to use AI and other security tools, the spokesperson said.

Editor's Summary

GMO Internet is investigating a suspected breach of its Onamae desktop cloud service after hackers posted alleged customer data and demanded about $50 million. The company shut down the service, reported the incident to police and advised password resets as it verifies the leaked material. The case follows separate reports of the Artex AI penetration-testing tool being used against companies in Japan, though GMO has not publicly linked the two.