Japan internet giant GMO says hackers posted stolen customer data

GMO Internet Confirms Data Publication After Major Breach

Japanese internet services giant GMO Internet is investigating a significant data leak following a cyberattack on its Onamae cloud desktop service, a platform primarily used by financial traders. The company confirmed that an attacker has likely published information stolen from its customers and business operations, though the authenticity and full scope of the published data are still under verification. This incident has potentially compromised up to 27,000 servers, prompting GMO Internet to advise all customers to reset their passwords after reports of unauthorized activity on trading accounts.

Anatomy of the Attack

The breach unfolded over several days, forcing the company to take drastic measures to contain the damage. The initial unauthorized access was discovered on October 21, leading to an immediate shutdown of the Onamae Desktop Cloud service and a ransom demand from the attackers for approximately $50 million. GMO Internet has since involved Japanese police, government agencies, and is offering compensation to affected customers while it analyzes user devices for malware to understand the attack vector.

• Oct 21: Unauthorized access detected; service shut down and ransom demand received.
• Oct 22: Incident reported to Japanese police.
• Oct 24: The company announced plans for customer compensation and alternative services.
• Oct 27: Attackers allegedly published stolen data online.

The Specter of AI-Powered Threats

This breach occurs as Japan’s own financial regulators are urging institutions to bolster cyber defenses, including the use of AI security tools. While GMO Internet has not publicly linked this specific incident to any particular tool, its own cybersecurity unit recently reported on a Chinese AI-enabled penetration testing tool called Artex being used in attacks across Japan. A recent report from CrowdStrike also connected Artex to hacks on financial institutions in South Korea, which exploited weak security controls like a lack of multi-factor authentication. The developer of Artex has since made the tool closed-source, highlighting the growing challenge of dual-use AI tools being weaponized for malicious attacks.

The GMO Internet breach exemplifies the escalating cybersecurity arms race, where regulators are advocating for AI as a defensive shield while threat actors are simultaneously weaponizing it for offense. This incident is a stark reminder that foundational security measures, such as multi-factor authentication, remain critical non-negotiables as the complexity and speed of attacks increase.