Japan's GMO Investigates Breach That May Affect 27,000 Servers

Japanese company GMO Internet announced that it is investigating a data leak after suspecting unauthorized access to its Onamae cloud desktop service, which provides virtual desktops for financial market traders, according to a report by TechCrunch.

The company stated in its blog post that it believes the attacker published information related to customers and its business, noting that the content is still being verified and the full scope of the incident remains unclear. It added that 27,000 servers could be affected by the breach.

GMO advised customers to change their passwords following reports of "unauthorized operations" on trading accounts, at a time when a company spokesperson did not respond to TechCrunch's request for comment. According to the timeline, the company suspended the service on October 21 after detecting the unauthorized access, and received an email from the attackers demanding approximately 8 billion Japanese yen, equivalent to nearly $50 million.

The incident comes about a week after the company's cybersecurity unit announced finding evidence of the use of an AI-powered Chinese penetration testing tool called Artex in attacks targeting companies in Japan, without establishing a public connection between the tool and the breach. Japan's Financial Services Agency had issued guidelines in May requiring financial institutions to bolster their defenses.

What Do These Terms Mean?

Cloud Desktop: A version of a desktop operating system running on remote servers, accessed by the user over the internet instead of a local device.

Unauthorized Access: Entry into a system or account without the owner's permission, considered an indicator of a potential breach.

Ransom Demand: A demand sent by an attacker in exchange for not publishing stolen data or for restoring access to encrypted systems.

Penetration Testing: An authorized simulation of a cyberattack to discover vulnerabilities before they can be exploited by real attackers.