GMO Internet warns FX cloud was compromised; attacker demanded $50 million

GMO Internet, a Japanese ISP, warned customers that its Onamae.com Desktop Cloud service, promoted as an environment for foreign exchange trading, was compromised by an attacker. The company said it was slow to fix security weaknesses, that customer and trading information may have been exposed, and that it received a $50 million ransom demand it will not pay.

Compromised trading environment

GMO said a third party installed malicious programs in the server environments of some customers. Some customers reported unauthorized operations on trading accounts, and third parties probably saw users' passwords for trading services. The company advised users to immediately change trading account passwords using a device not used for trading. It also said its systems had security vulnerabilities, its environment was accessed without authorization, and customer information was taken outside the company. Some customers reported unrecognized transactions, and GMO asked major trading services to terminate active sessions, monitor for unauthorized transactions, and block trade requests from the Onamae.com Desktop Cloud.

Ransom and customer support

GMO said it received a demand for money from a person believed to be the attacker, who wants $50 million. It will not pay because payment would not guarantee deletion or prevent misuse of the information. Investigations continue, with GMO warning that 26,739 VDI servers may have been hit and users' personal devices may be at risk. The company is offering all users a ¥5,000 ($32) condolence payment and promised to cover trading losses caused by the attack. GMO also warned that some trading apps may keep sessions alive after password changes, and advised users to check their securities or FX company's guidance or account page and disconnect all active sessions or ask support to do so.

CEO admits slow response

In a blog post, CEO Masatoshi Kumagai described the ¥5,000 payment as a token of initial sincerity toward customers who experienced inconvenience and worry. He said GMO will use full group resources to provide a free alternative environment for six months, overhaul system infrastructure, and investigate the cause and prevent recurrence with external experts. Kumagai admitted in-house white-hat hackers had previously pointed out areas for improvement, and the team was working on countermeasures. He said the company proceeded cautiously, considering service availability and prioritizing other issues, and that its response lacked sufficient depth and speed, allowing attackers to exploit the vulnerability. He said he regrets that, despite having professionals on staff, GMO failed to turn their expertise into effective defenses as an organization.

AI and public-private defense

Kumagai said open weight AI models can be combined and spread into countless attack tools, transforming cyberattacks from acts requiring advanced skills into acts anyone can easily carry out. He said GMO Group's cybersecurity operation confirmed that the source of an unauthorized access attack targeting about 20 Japanese companies was misuse of 'ARTEX,' an autonomous AI penetration testing tool originally intended for defense. Kumagai said public and private partnerships are needed to improve information security across Japan, and GMO submitted a proposal to the government to 'apply proactive cyber defense.' He said GMO is not trying to shift blame onto the government or beg for a bailout, but argued that without national-level defenses, more such incidents are unavoidable.

Sources: The Register