[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

3 clusters · 42 sources · 3 days · First seen · Last updated

Cyberattacks on Japanese financial services

Overview

A series of significant cyberattacks has targeted Japanese financial institutions. GMO Internet Group reported a major breach of its ‘Onamae.com Desktop Cloud’ service, which impacted up to 26,739 servers used for automated foreign-exchange (FX) trading. The attackers, identifying as ‘Hacking Team’, allegedly hijacked brokerage accounts at over 70 firms to execute unauthorized trades, causing substantial financial losses for some users. The hackers have demanded a $50 million ransom in cryptocurrency and threatened to leak sensitive customer and company data, though GMO Internet has refused to pay.

In the wake of the breach, GMO Internet Group requested that the Japanese government invoke ‘active cyber defense’ powers to allow state agencies to neutralize the attackers’ infrastructure. The Japanese government has responded with caution, stating that active cyber defense is not typically triggered by individual corporate requests and requires detailed analysis and approval from independent oversight bodies.

Following the incident, GMO Internet Group CEO Masatoshi Kumagai issued a formal apology, admitting that while internal white-hat hackers had previously identified security vulnerabilities, the company failed to implement sufficient defenses due to difficulties in balancing security updates with service continuity and other operational priorities. Following these developments, GMO shares fell nearly 16%, reaching a four-month low.

To mitigate the impact, GMO Internet announced it will compensate users for actual trading losses and fees, provide a 5,000 yen consolation payment to all current users, and offer six months of free service to those migrating to an alternative service being prepared on new, independent infrastructure.

Additionally, Nomura Securities reported a potential leak of customer email addresses following unauthorized access to a system managed by its subcontractor, Yumirink Co., Ltd. While Nomura stated that trading account information and portfolio data were not compromised, the company advised customers to watch for phishing attempts.

Entities

Japan · GMO Internet Group · Masatoshi Kumagai · Onamae.com Desktop Cloud · Onamae.com

Claims

What the coverage asserts, and how many sources carry each claim.

Timeline

  1. [TECHNOLOGY] 16 sources
    GMO Internet apologizes for cyberattack on cloud service

    GMO Internet CEO Masatoshi Kumagai apologized for a cyberattack on its cloud service that potentially impacted 26,739 servers. The company refused a $50 million ransom and is compensating affected users.

  2. [BUSINESS] 3 sources
    Nomura Securities and GMO Internet report major data breaches

    Nomura Securities faces a potential email leak via a subcontractor, while GMO Internet reports a massive breach affecting over 26,000 trading servers and multiple brokerage accounts.

  3. [TECHNOLOGY] 25 sources
    GMO Internet Group requests active cyber defense after major breach

    GMO Internet Group has requested Japan use active cyber defense powers after a breach of its Onamae.com Desktop Cloud service led to unauthorized FX trades and ransom threats.

Sources

agora-web.jp · alfalfalfa.com · arabic.euronews.com · ascii.jp · bittimes.net · bizmakoto.jp · crypto-times.jp · devdiscourse.com · dxmagazine.jp · euronews.net · fnn.jp · fr.euronews.com · hamusoku.com · insurancejournal.com · internet.watch.impress.co.jp · it-boltwise.de · ithome.com · itnews.com.au · iussp.org · j-cast.com · japan.cnet.com · japantimes.co.jp · journalducoin.com · jugem.jp · kjopesenter.no · marketpress.jp · news.bitcoin.com · news.cube-soft.jp · news.mynavi.jp · newsbytesapp.com · nishinippon.co.jp · nouvelles-du-monde.com · rande-academy.cz · saferworld.org.uk · scan.netsecurity.ne.jp · submitnews.com.au · thecyberexpress.com · theNEXTweb.com · tokyo-sports.co.jp · weekly.ascii.jp · world-today-journal.com · zdnet.co.kr

This summary has been updated 4 times: see revision history