GMO Internet has confirmed that hackers posted stolen customer data linked to its Onamae cloud desktop service.
The breach involves the virtualized desktops used by financial traders. The company states the attacker has released information allegedly tied to customers and the business, though verification is ongoing and the full scope remains unknown.
GMO Internet has advised users to reset passwords after reports surfaced of “unauthorized operations” on trading accounts. The firm estimates up to 27,000 servers may be affected.
A spokesperson for GMO Internet declined to comment on TechCrunch’s request.
Connection to Artex tool
This incident follows a report from the company’s cybersecurity unit about a week prior, noting evidence of a Chinese AI-enabled penetration testing tool called Artex in hacks across Japan. The company has not publicly linked Artex to the Onamae breach.
CrowdStrike reported earlier this month that Artex was also used to hack financial institutions in South Korea in September. Those attacks exploited weak security controls, such as missing multi-factor authentication. The tool’s Chinese developer stopped public updates and closed the source code after the cyberattacks were linked to banks.
A spokesperson at Japan’s Financial Service Agency (FSA) told TechCrunch that guidance issued in May urged financial institutions to prepare for a rise in cybersecurity vulnerabilities.
The regulator called for stronger basic defenses, including “vulnerability management, defense-in-depth and incident preparedness,” while encouraging firms to use AI and other security tools.
Timeline
Oct 21: GMO Internet shut down its Onamae Desktop Cloud service after discovering unauthorized access to its systems. The IT firm also received an email from hackers demanding about 8 billion yen (~$50 million).
Oct 22: The Japanese company reported the incident to Japanese police and shared another public update.
Oct 24: GMO Internet said it would offer customers compensation and alternative service while seeking help from government agencies.
Oct 25-26: The company began collecting devices from customers to detect malware and better understand the damage.
Oct 27: The Japanese IT firm said a suspected attacker had posted information that appeared to be linked to the company and its customers. GMO said it was still checking whether the information was genuine.
What it means
Traders using Onamae should treat their credentials as compromised and change them immediately. The firm is actively removing malware from customer machines to assess the damage.
