GMO says attackers demanded $50 million; customer data reportedly posted after deadline

GMO Internet Group chairman and president Masatoshi Kumagai (熊谷正寿) said on his blog on 26 October that attackers behind the unauthorised access to a group company had demanded $50 million (about 7.9 billion yen) in cryptocurrency, due by 17:00 on 21 October. Yomiuri Shimbun reported that the attackers made contact at 11:57 on 21 October and asked for payment in Bitcoin or Ethereum. Nikkei and Mainichi Shimbun said it was the first time GMO had disclosed the amount requested. Kumagai said: "We have not complied with these demands and have made no payment whatsoever." [ 3 , 7 , 8 , 9 , 12 ]

GMO announced on 21 October that its cloud service for users who run automated FX trading had been accessed without authorisation, and users had reported unfamiliar operations on their trading accounts. Yomiuri said the service is "Onamae.com Desktop Cloud", that an unauthorised program was confirmed on some servers on 20 October and that the servers were stopped at 04:00 on 21 October. Mainichi reported that 26,739 servers may have been affected, and TBS said account IDs and passwords may have been misused. A 44-year-old user told TBS he lost more than 4 million yen in two seconds. [ 3 , 4 , 8 , 9 ]

In his 25 October blog, Kumagai apologised and acknowledged that in-house experts had pointed out weaknesses beforehand, but that measures had not been sufficient. Sankei Shimbun reported that the response had been put off to avoid affecting the service. He asked the government to apply "active cyber defense", and said GMO Internet would check unauthorised trades and compensate users' losses. Nippon TV reported that GMO also has a 200-person effort on defense and log analysis. [ 3 , 4 , 7 , 9 , 11 , 12 ]

The attackers published a demand on their own website on 24 October, Nikkei reported, saying they would not launch ransomware attacks on users if they were paid $1 million by noon on 27 October. NHK reported this as about 157 million yen. Nikkei noted that this differs from GMO's $50 million figure in both amount and timing. According to Asahi Shimbun, Kumagai's blog said the attackers also hinted at continued unauthorised operations on accounts, publication of data on customers' PCs and ransomware. GMO announced on the night of 26 October that it had been warned of customer information being published and ransomware used at noon on 27 October. [ 2 , 3 , 7 , 12 , 14 ]

On 27 October GMO asked users to back up data, disconnect from the network, power off and unplug their PCs before noon. ITmedia reported that staff were collecting customers' devices and that the group's white-hat hacker team was analysing them. ITmedia said no malware, including ransomware, had been found on devices already analysed as of 11:59. [ 22 , 23 , 28 , 30 , 39 ]

After noon, a statement attributed to the attackers appeared online. Kyodo News, carried by Tokyo Shimbun, said it posted part of what it described as customers' personal information, citing several security sources, because GMO had not met the ransom demand. GMO answered that it would refrain from commenting on individual matters, and Kyodo said the statement's authenticity might still call for caution. Yomiuri and TBS reported one person's information and TBS said the group would publish daily at noon. Finance Minister Satsuki Katayama said at a press conference that she had asked financial institutions to take appropriate steps, including preventing further damage. [ 17 , 18 , 32 , 37 ]