GMO INTERNET INVESTIGATES ONAMAE DESKTOP CLOUD DATA LEAK

GMO Internet said it was investigating a data leak following unauthorised access to its Onamae Desktop Cloud service. The Japanese company said attackers installed malware in some customers’ server environments. It shut down the service on 21 October and began checking affected systems. GMO told customers to scan for viruses, back up data, reset passwords and “unplug any cords connected to your PC”. The company also received reports of unauthorised activity on customers’ trading accounts.

Onamae Desktop Cloud supplies hosted Windows desktops used by retail foreign exchange traders in Japan to run automated trading software. GMO disclosed the intrusion on 20 October. Figures given for the number of servers potentially affected range from 26,739 to about 27,000. Hackers emailed a demand for about eight billion yen, roughly $50 million, to delete data they said they had taken, according to GMO. GMO said it would not pay. Information purporting to concern customers and the business later appeared online, and GMO said it was still verifying its contents and the breach’s full extent.

GMO’s cybersecurity unit said a week earlier that it had found evidence of Artex, a Chinese AI-enabled penetration testing tool, in attacks on Japanese companies. GMO has not publicly linked Artex to the Onamae breach. CrowdStrike said attackers used the tool against financial institutions in South Korea in September and exploited weak security controls, including missing multifactor authentication. Japan’s Financial Service Agency said it had urged financial institutions in May to strengthen vulnerability management and incident preparedness, and to consider AI security tools.