0
Masatoshi Kumagai, chairman of GMO Internet Group, bows in apology during a press conference in Tokyo, Japan, on Nov. 2 over damage caused by a cyberattack. / Reuters-Yonhap

Japan's GMO Internet Group has been found to have failed to adequately address security vulnerabilities in its cloud service despite receiving internal warnings two years ago. The company failed to detect an attacker who had infiltrated customer servers for approximately two and a half months, during which unauthorized trades and financial losses continued to occur in users' foreign exchange margin trading (FX) accounts.

Major Japanese media outlets reported on Nov. 2 that Masatoshi Kumagai, chairman and CEO of GMO Internet Group, held his first press conference since the incident at 3 p.m. that day in Tokyo, acknowledging security flaws and an inadequate response.

"It is true that there were security problems with the service system," Kumagai said, apologizing for the company's failure to incorporate warnings from experts within the group into the operation of the service.

The company announced that it would reduce the compensation of four executives, including Kumagai, by up to 30% for three months starting in December to hold them accountable for management failures.

According to the company, the security issue was first identified in April 2024 by an expert at GMO Cybersecurity by Ierae, a cybersecurity company within the group. Although the company carried out emergency maintenance four times between April and May of that year and applied security patches, it failed to resolve the underlying problem.

The warnings were passed on to two vice presidents but were reportedly not brought to Kumagai's attention. Hiroshi Yamashita, vice president of GMO Internet, explained that the inadequate response was "a decision made in light of development priorities."

The attacker infiltrated a customer server environment on Aug. 5 this year. On Aug. 17, the attacker also gained unauthorized access to a management server after stealing administrator privileges.

However, the company did not discover the problem until Oct. 20, when it launched an investigation following an inquiry from a user. This was approximately two and a half months after the initial intrusion.

The service was suspended the following day, Oct. 21. A total of 26,739 customer virtual servers may have been affected. The company said the exact route of the initial intrusion had not yet been identified.

		0
An image of a GMO booth. / Screenshot from the GMO Group website

500,000 yen lost in 45 seconds 

The service targeted in the attack was "Onamae.com Desktop Cloud," provided by GMO Internet. It was a virtual private server (VPS) service that divided a large physical server into multiple independent virtual servers and rented them to customers. Users installed programs such as automated foreign exchange (FX) trading software on these servers, allowing the programs to continue running remotely even when their home computers were turned off.

The problem was that the attack on the external servers hosting the trading programs also caused losses in the linked financial accounts. According to the Mainichi Shimbun, unauthorized trades occurred in some customer accounts at five FX companies in Japan. The servers stored sensitive information, including usernames and passwords used for trading.

However, the explanation that the attack spread because of a vulnerability allowing access between individual customers' servers is a claim made by the attacker. Further investigation is needed to determine the relationship between the security problems acknowledged by the company and the actual routes of intrusion and spread.

In a related report, the Sankei Shimbun said a 47-year-old man living in Tokyo lost approximately 500,000 yen (about 4.25 million won) through 97 unauthorized trades executed within 45 seconds. Only 47 yen reportedly remained in his account after the trades.

The man said he had chosen the service because he trusted GMO's strong brand recognition and security promotions, and that he was deeply shocked by what he saw as a betrayal of that trust. He also complained that, after reporting the losses, he faced delays in receiving information about compensation procedures and was even instructed not to use his computer, disrupting his work.

		0
A view of Shibuya Fukuras, a building housing major offices of GMO Internet Group in Shibuya, Tokyo, Japan. / Edomura no Tokuzo, Wikimedia Commons

A 44-year-old office worker in Kanagawa Prefecture interviewed by the Asahi Shimbun said he had lost approximately 6 million yen (about 51 million won) through unauthorized trades. Even users who did not suffer direct trading losses said they had incurred additional expenses, such as purchasing separate backup devices. Criticism also emerged over why the company had failed to respond adequately despite internal warnings.

GMO plans to pay a flat 5,000 yen (about 42,500 won) in compensation for inconvenience to all users of the affected service and fully reimburse losses confirmed to have resulted from unauthorized trades caused by the breach. The company also plans to provide separate compensation to users whose information was disclosed. The total compensation amount and its impact on the company's financial performance are still being assessed.

GMO said the attacker had demanded money and threatened to release customer information, but the company refused to pay. On Oct. 27, information purportedly belonging to one customer was published online. The company said it had not confirmed any further disclosures and had not been in contact with the attacker since Oct. 23.

Asked about the possibility of involvement by a North Korea-linked hacking group, Kumagai avoided giving a specific answer, saying he could not comment because the matter was under investigation. The company said it had submitted credible information concerning the perpetrator to police.

During the press conference, Kumagai also became tearful while explaining the management philosophy he had followed since founding the company. He apologized for posting smiling photos and other content on his social media accounts after the incident, acknowledging that he had shown insufficient consideration for the victims.

Regarding the government's response, GMO requested the application of "active cyber defense" measures last month. Japan's Ministry of Internal Affairs and Communications asked domestic telecommunications operators to block access to the attacker's website. However, Kumagai said GMO was not eligible for active cyber defense measures.

On Oct. 29, the Tokyo Metropolitan Police Department established an investigation headquarters comprising approximately 70 officers. Police plan to analyze materials submitted by GMO and question relevant individuals, with possible violations of the Act on Prohibition of Unauthorized Computer Access among the suspected offenses.

                                                                                                           Choi Young-jae