Japan’s GMO refuses hackers’ $50 million demand

Group CEO Masatoshi Kumagai wrote on Oct. 26 that GMO Internet spurned a $50 million demand from hackers who broke into its Onamae.com Desktop Cloud service.

As many as 26,739 servers may be affected and some customers said they saw unauthorized trades made through their brokerage accounts.

Up to 26,739 Onamae.com servers may be affected

Onamae.com Desktop Cloud runs brokerage software like MetaTrader 4 and MetaTrader 5 on customer servers. GMO said an attacker exploited a security flaw, planted malware in some customer environments and took customer data.

The issue was first reported by a customer question on October 19. The following day, malware was detected and GMO began to shut down all plans from 19:00 UTC on October 20.

The figure of 26,739 is a count of potentially impacted servers, not verified breaches. Some customers reported trades placed without permission via tools running on the service.

In-house white-hat hackers had flagged security issues with the service in advance. The response was lacking in depth and speed, Kumagai wrote, and the attacker passed through the gap.

GMO Internet Group shares shed almost 16% to a four-month low Monday. The company said it could not yet quantify the impact on earnings of the goodwill payments and compensation for losses.

Attacker threatened accounts at over 70 securities and FX firms

Kumagai’s blog post, first published Oct. 25 and updated a day later, lists what the attacker threatened. The list begins with more fraudulent orders on customer accounts at more than 70 securities and foreign-exchange firms in Japan and abroad.

The attacker also threatened to leak data from customer PCs that were connected, use ransomware and publish internal details of GMO’s systems. Those were threats, not confirmed activity at all 70-plus firms.

A document stamped 11:57 on October 21 demanded $50 million, about 8 billion yen. None of the demands were met by GMO and nothing was paid, Kumagai wrote.

The note asked for payment in Bitcoin or Ether by 5 p.m. Japan time that day and said GMO’s crypto exchange subsidiary could pay immediately.

GMO stated that paying would not guarantee the stolen data would not be misused. It is working with police and other authorities on the matter.

Kumagai dismissed criticism that a flat 5,000 yen goodwill payment to all customers was an attempt to close the issue. It was the first step, he said.

GMO Internet will verify and compensate for fraudulent trade losses related to the breach. If an exchange refuses a refund, it pays the full amount of eligible losses itself.

The group also pledged a six-month free replacement environment, a reconstruction of its system base and an outside review of the root cause. GMO Cyber Security by Ierae and GMO Flatt Security are involved in defense and log analysis with approximately 200 security staff, including former Interpol personnel.

GMO has also begun court disclosure requests to track down the attackers.

Kumagai called the attack a symbol of an “AI cyber saturation attack,” with inexpensive AI tools that enable attackers to overpower defenders. GMO Cyber Security by Ierae found the autonomous AI penetration-testing tool ARTEX, built for defense, misused in attacks on some 20 Japanese companies.

He also mentioned the recent PHP flaws where automated attack attempts ran to millions in hours. According to Cryptopolitan, the two PHP2Shell bugs have a severity score of 9.2 out of 10 and PHP shipped fixes on October 21.

GMO has not connected its own breach to the PHP flaws.

On Oct. 24, Kumagai asked Tokyo to apply Japan’s law on active cyber defense, which went into effect Oct. 1. GMO is not a designated critical-infrastructure operator under the law, and he acknowledged that the decision lies with the government.

Prime Minister Sanae Takaichi said Monday evening the government plans an emergency package of cybersecurity safeguards by sometime next week.