Japanese internet giant GMO says hackers published Onamae customer data
Japanese internet company GMO Internet said that after unauthorized access to its Onamae cloud desktop service, suspected attackers have published information related to customers and business operations, with the content still being verified, and that approximately 27,000 servers may be affected. The company has advised customers to reset their passwords and said it has received reports of unauthorized activity on customer transaction accounts. The timeline shows that GMO shut down the service on October 21 and received an email from hackers demanding about 8 billion yen (roughly $50 million); GMO said it has not yet confirmed that this intrusion is related to the AI penetration testing tool Artex.
Why read this
AI score 55
The original article lays out the timeline of how GMO's Onamae cloud desktop was compromised and the subsequent response, and notes that a connection to the AI penetration testing tool Artex has not yet been confirmed.
Topics
Body
Japanese internet company GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae cloud desktop service, which provides virtualized desktops to financial traders
The IT and internet services giant said on its blog that it believes the attacker has published information allegedly linked to customers and its business. However, the contents are still being verified and the full extent of the incident remains unclear.
GMO Internet has since advised customers to reset their passwords, amid receiving reports of “unauthorized operations” performed on customer trading accounts. The company said 27,000 servers may be affected by the breach.
A spokesperson for GMO Internet did not respond to TechCrunch’s request for comment.
The incident comes about a week after the Japanese firm’s cybersecurity unit separately reported finding evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan. However, the company said it has not publicly established a connection between Artex and the breach of Onamae.
The Artex tool was also used to hack financial institutions in South Korea in September, according to a report by CrowdStrike earlier this month. The attacks largely relied on exploiting weak security controls , such as a lack of multi-factor authentication. Artex’s Chinese developer has since stopped public updates and made the AI security tool closed-source after it was linked to cyberattacks targeting banks, per Reuters .
A spokesperson at Japan’s Financial Service Agency (FSA) told TechCrunch that it issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities.
The regulator called for stronger basic defenses, including “vulnerability management, defense-in-depth and incident preparedness,” while encouraging firms to use AI and other security tools, the spokesperson added.
Here’s the timeline of the Onamae breach.
Oct 21: GMO Internet shut down its Onamae Desktop Cloud service after discovering unauthorized access had occurred to its systems without permission. The IT firm also received an email from hackers demanding about 8 billion yen (~$50 million).
Oct 22 : The Japanese company reported the incident to Japanese police and shared another public update .
Oct 24 : GMO Internet said it would offer customers compensation and alternative service while seeking help from government agencies.
Oct 25-26: The company began collecting devices from customers to detect malware and better understand the damage.
Oct 27 : The Japanese IT firm said a suspected attacker had posted information that appeared to be linked to the company and its customers. GMO said it was still checking whether the information was genuine.