GMO Internet Says Hackers Posted Data After Onamae Breach; 8 Billion Yen Ransom Demanded

5.6 · 6d ago · WORLD · TECH

The Facts

  • Hackers demanded about 8 billion yen (~$50 million) from GMO Internet by email; Bloomberg reports they threatened to leak customer data unless paid $50 million. ✓2 · TechCrunch, Bloomberg
  • GMO Internet said customers will be compensated for losses from unauthorised access; all customers will receive 5,000 yen (about US$32) as 'an initial gesture of good faith', per CEO Masatoshi Kumagai's blog post on Sunday. ✓2 · SCMP, TechCrunch
  • GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae Desktop Cloud service, which provides virtualized desktops to financial traders. TechCrunch only
  • On Oct 27, GMO said a suspected attacker had published information that appeared linked to the company and its customers; the company is still verifying whether it is genuine. TechCrunch only
  • GMO Internet shut down the Onamae Desktop Cloud service on Oct 21 and reported the incident to Japanese police on Oct 22. TechCrunch only
Dive deeper · 7 more factsShow less
  • GMO said up to 27,000 servers may be affected and advised customers to reset passwords after receiving reports of 'unauthorized operations' on customer trading accounts. TechCrunch only
  • On Oct 25-26 GMO began collecting customer devices to detect malware and assess the damage. TechCrunch only
  • GMO's cybersecurity unit reported about a week earlier evidence that a Chinese AI-enabled penetration testing tool, Artex, was used in hacks on Japanese companies; GMO has not publicly linked Artex to the Onamae breach. TechCrunch only
  • CrowdStrike reported Artex was used against South Korean financial institutions in September, largely exploiting weak controls such as missing multi-factor authentication. TechCrunch only
  • Japan's Financial Services Agency issued guidance in May urging financial institutions to strengthen defenses against rising cyber vulnerabilities. TechCrunch only
  • The attack adds to a wave of cyberattacks in Japan that has prompted the government to draw up emergency measures. Bloomberg only
  • Japan said it would set up a team to simulate cyberattacks using AI to identify weaknesses in technology systems, as organisations scrambled to address flaws in the PHP programming language. SCMP only

Context

GMO Internet, a Japanese internet services company, is investigating a breach of its Onamae Desktop Cloud service used by financial traders. The company shut the service on Oct 21 and reported the incident to police the next day.

On Oct 27 GMO said a suspected attacker had posted information apparently tied to the company and its customers, which it is still verifying. The company has offered compensation and an initial 5,000 yen payment to customers.

The breach comes amid a wave of cyberattacks in Japan and the use of AI-enabled hacking tools in the region.

How the Agent Panel Scored This

Independent AI personas each scored importance 1–10; the story's score is a trimmed mean (highest and lowest votes dropped). Vote spread: 2.

6 Critical Reader A confirmed breach with a service shutdown, up to 27,000 servers possibly affected, a $50M ransom demand, and customer compensation is significant for financial traders in Japan, but the posted data remains unverified and the story is an ongoing investigation with limited confirmed measurable outcomes.
6 News Editor A confirmed-in-part breach of a Japanese hosting provider affecting up to 27,000 servers and financial traders, with a ransom demand and compensation offer, is newsworthy with moderate-to-significant reach, though the leak is still unverified and the impact is confined to a niche customer base.
6 Policy Expert A breach at a Japanese hosting provider affecting up to 27,000 servers used by financial traders, with unauthorized trades, a $50M ransom demand, service shutdown, and compensation, is a notable concrete event with moderate-to-significant impact, though it is a single company incident and not a government action.
6 Science & Tech Analyst A significant breach at a major Japanese internet firm affecting up to 27,000 servers and financial traders' accounts with a $50 million ransom demand is newsworthy and consequential, though its impact is regional and still being verified.
5 Global Affairs Analyst A significant corporate data breach affecting up to 27,000 servers and financial traders with a $50 million ransom demand is newsworthy and moderately important, but it is a single company incident without broad systemic or geopolitical impact.
5 Informed Citizen A breach affecting up to 27,000 servers of financial traders, with unauthorized trading operations and a $50 million extortion demand, is newsworthy with moderate broad impact, though the story is limited to one company's customers and mostly ongoing investigation.
4 Business Analyst A significant breach at a major Japanese internet firm affecting up to 27,000 servers and financial traders, with a $50M ransom demand, is notable but remains a company-specific incident with limited broad market impact so far.

Sources (3)

← All stories