GMO Internet investigates Onamae breach after hackers post customer data

Japanese internet company GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae cloud desktop service, which provides virtualized desktops to financial traders. The company said on its blog that an attacker appears to have published information allegedly linked to customers and its business, while the contents are still being verified and the full extent remains unclear. GMO has advised customers to reset passwords amid reports of unauthorized operations on customer trading accounts.

Breach scope and customer response

GMO Internet said 27,000 servers may be affected by the breach. A spokesperson for the company did not respond to TechCrunch's request for comment. The company also received reports of unauthorized operations performed on customer trading accounts and told customers to reset passwords.

Connection to Artex is unconfirmed

The incident comes about a week after GMO's cybersecurity unit separately reported finding evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan. GMO said it has not publicly established a connection between Artex and the Onamae breach. Artex was also used to hack financial institutions in South Korea in September, according to a report by CrowdStrike earlier this month. Those attacks largely relied on exploiting weak security controls, such as a lack of multi-factor authentication. Artex's Chinese developer has since stopped public updates and made the AI security tool closed-source after it was linked to cyberattacks targeting banks, per Reuters.

Regulatory guidance and timeline

A spokesperson at Japan's Financial Service Agency told TechCrunch that it issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities. The regulator called for stronger basic defenses, including vulnerability management, defense-in-depth and incident preparedness, while encouraging firms to use AI and other security tools. Oct 21: GMO shut down its Onamae Desktop Cloud service after discovering unauthorized access had occurred without permission and received an email from hackers demanding about 8 billion yen (~$50 million). Oct 22: the company reported the incident to Japanese police and shared another public update. Oct 24: GMO said it would offer customers compensation and alternative service while seeking help from government agencies. Oct 25-26: the company began collecting devices from customers to detect malware and better understand the damage. Oct 27: the company said a suspected attacker had posted information that appeared to be linked to the company and its customers, and it was still checking whether the information was genuine.

Sources: TechCrunch