started · updated
GMO Internet Group requests active cyber defense after major breach
GMO Internet Group has requested that the Japanese government invoke its newly enacted “active cyber defense” powers following a significant cyberattack on its Onamae.com Desktop Cloud service. The breach, which targeted servers used primarily for automated foreign exchange (FX) trading, potentially affected up to 26,739 servers.
Attackers reportedly gained access to authentication information, including login credentials for trading tools like MT4 and MT5. This led to reports of unauthorized trades, with some users experiencing rapid financial losses. The hackers, identifying themselves as “Hacking Team,” have demanded a ransom, threatening to continue unauthorized operations across more than 70 securities and FX firms, as well as leaking sensitive customer and company data.
GMO Internet Group has stated it will not pay the ransom, noting that payment does not guarantee the deletion of stolen data. To mitigate impact, the company announced it will compensate users for actual trading losses caused by the unauthorized access. Additionally, all service users will receive a 5,000 yen consolation payment, and the company will offer six months of free service on an alternative cloud platform as part of a security architecture overhaul.
Entities
GMO Coin · GMO Internet Group · Hacking Team · HackingTeam · Japan · Japanese Government · Kumagai Masatoshi · Masatoshi Kumagai · OANDA Japan · Onamae.com · Onamae.com Desktop Cloud
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 13 SOURCES] GMO Internet Group refused to pay the ransom demanded by the attackers. www.watch.impress.co.jp · nationalcybersecurity.com · www.nouvelles-du-monde.com · agora-web.jp · thenextweb.com · +5 more
- [● 14 SOURCES] The cyberattack targeted the Onamae.com Desktop Cloud service. www.watch.impress.co.jp · nationalcybersecurity.com · agora-web.jp · thenextweb.com · www.nouvelles-du-monde.com · +6 more
- [● 5 SOURCES] The company will provide six months of free service on an alternative cloud platform. www.watch.impress.co.jp · bittimes.net · zdnet.co.kr · internet.watch.impress.co.jp
- [● 7 SOURCES] All current users of the service will receive a 5,000 yen consolation payment. www.watch.impress.co.jp · bittimes.net · www.japantimes.co.jp · zdnet.co.kr · www.fnn.jp · +1 more
- [● 11 SOURCES] Up to 26,739 servers may have been affected by the breach. www.watch.impress.co.jp · nationalcybersecurity.com · agora-web.jp · thenextweb.com · news.cube-soft.jp · +5 more
- [● 6 SOURCES] The company will compensate for actual trading losses and fees caused by the unauthorized access. www.watch.impress.co.jp · bittimes.net · zdnet.co.kr · www.fnn.jp · internet.watch.impress.co.jp
- [● 15 SOURCES] GMO Internet Group requested the Japanese government apply active cyber defense powers. www.watch.impress.co.jp · nationalcybersecurity.com · thenextweb.com · www.japantimes.co.jp · zdnet.co.kr · +7 more
- [● 5 SOURCES] Attackers threatened to continue unauthorized operations at over 70 securities and FX firms. nationalcybersecurity.com · thenextweb.com · www.watch.impress.co.jp · bittimes.net