A Nearly $50 Million Ransom Shakes GMO Shares After Forex Trading Environment Breach
Key Facts
Onamae.com Desktop Cloud, a service operated by GMO Internet, a subsidiary of GMO Internet Group, was breached, allowing unauthorized access to customer server environments. The company confirmed that customer information had left its systems. GMO said security vulnerabilities in the service’s systems enabled the access, while some customers reported unknown transactions in their trading accounts. The service is used to host automated foreign-exchange trading environments, making the incident a breach of infrastructure customers rely on to run their trades. TechCrunch reported that the attackers demanded about 8 billion yen, or nearly $50 million. The company said it would not pay, while the group’s shares fell by the most since 2011 on October 26, according to Bloomberg, as cited by The Straits Times.
GMO began investigating on October 19 after receiving inquiries from customers, then confirmed the presence of malware on October 20. On the same day, it suspended acceptance of new orders and shut down the service’s control panel, before beginning to shut down servers across all plans on October 21. Company disclosures showed that 26,739 servers may have been affected. These measures are part of a response to a threat affecting customer environments, rather than a suspension of trading services at brokerage firms. GMO also asked exchanges and securities companies to block access through the service, terminate active sessions and monitor for unauthorized transactions. It said it had isolated the affected systems from networks and blocked external routes.
In a notice issued on October 27, the company said the suspected attacker had threatened to publish customer information and launch a ransomware attack at 12:00 noon Japan time. GMO asked customers to back up their files, disconnect their devices from the network, shut down their computers and unplug connected cables before the deadline. At 11:59 that day, the company said its examination had found no malware, including ransomware, on devices whose analysis had been completed. But it said analysis was ongoing, so this did not confirm that all customer devices were safe. It also said verification of material allegedly stolen was still underway, and its notices had not confirmed that the data had been published.
GMO rejected the demand for money, saying payment would not guarantee the deletion of information obtained by the attacker or prevent its misuse. It added that it had submitted evidence to police and requested a criminal investigation. Separately, the company announced on October 24 that it would pay 5,000 yen to each customer currently using the service, regardless of whether they had suffered a financial loss. It also pledged to compensate realized losses resulting from unauthorized transactions confirmed by its investigation. The scope of additional compensation therefore depends on the results of the verification of those transactions, while the fixed payment covers all current customers eligible under the company’s announcement.
The share-price decline on October 26 came as concerns over the impact of the breach deepened, according to Bloomberg in a report cited by The Straits Times. Investing.com said the shares rose 1.7% on October 27, after falling about 16% in the previous session. The two-day move shows investors continued to track developments in the incident, while the investigation into the data and devices remained underway. The financial response involves a fixed payment to customers and a separate process for compensating trading losses confirmed by the company. The cited report did not provide an aggregate estimate of compensation costs or losses that investigations might confirm.
GMO set October 30 as the date to notify eligible customers by email about how to receive the 5,000-yen payment and its schedule. It also said it would announce the procedures for submitting compensation claims by November 6. These dates follow the suspension of new orders and the shutdown of servers, as examinations of devices and material allegedly taken from the service continue. The findings of the review will determine which unauthorized transactions the company confirms for the purposes of additional compensation. The suspected attacker set the deadline for publishing the information and launching the ransomware attack for noon on October 27, while examinations completed by 11:59 that day found no malware on the devices analyzed.