GMO breach: data posted, users told to power off; SMB steps

1. What happened on October 27

GMO Internet Group said it had been warned by a suspected attacker that customer information would be published and a ransomware attack launched at 12:00 on October 27. In its 8th report, as of 9:58 that morning, it asked users to back up their data, disconnect the network and power off their PCs (GMO report 8). The group says it received a threatening email on October 21 that included a demand of about 8 billion yen, and that it will not comply (GMO report 10).

As of 11:59, no malware had been found on the customer PCs analysed so far, but GMO says this does not mean every PC has been confirmed safe. It will provide a new PC of equivalent performance to users hit by ransomware (GMO report 9). The group confirmed at 12:30 that a suspected attacker had published information; it is still verifying the content, which may include false material. As of 13:55 it had not confirmed any ransomware attack (GMO report 10).

2. The leak site users were told not to open, and GMO's response

GMO is asking people not to visit or spread the site the attacker published. It says it has confirmed that information about visitors to that site is captured by the attacker; it urges anyone who has already visited to run a full scan with security software, and says it cannot take responsibility for harm caused by visiting. It also asks people not to repost the material, share it on social media or share links to it, and says it is preparing legal action, including disclosure requests and criminal complaints, against malicious spreaders (GMO report 11, ITmedia NEWS). GIGAZINE reports that the author of a third-party site that makes the attacker's statements readable warns that the attacker's site contains a mechanism that records visitors' IP addresses and environments, and advises against opening it directly (GIGAZINE).

In its 12th report at 19:10 the same day, GMO announced a special condolence payment of up to 3 million yen per publication for users whose information was published. It also created a bounty of up to 1 million dollars (about 150 million yen) in total for information that helps solve the case, with submissions open from 12:00 on October 28. The amount is the cap for the whole programme, not a payment to one person (GMO report 12, ITmedia NEWS). GMO states that it will never comply with the attacker's demands.

Our view What stands out is that the company has had to tell victims not to look, not to spread it and to switch their machines off. If someone opens the attacker's site out of curiosity, information about their own PC and working environment may be taken too. When the matter is being discussed among customers and peers, a single employee who opens the link to check becomes a new way in. Scam emails and texts that piggyback on the incident also look more convincing the more real data is out there. Whether a company stops people opening links just to see what the fuss is about will, we believe, decide whether it suffers secondary damage.

3. Signs that AI is being used in attacks

According to TechCrunch, GMO's cybersecurity unit said about a week earlier that it had found evidence a Chinese AI-enabled penetration-testing tool called Artex had been used in attacks on companies across Japan. GMO has not publicly established a link between Artex and the Onamae breach. The article adds that Artex was also used against South Korean financial institutions in September, in attacks that largely exploited weak basic controls such as a lack of multi-factor authentication. It also says Japan's Financial Services Agency told it that it issued guidance in May urging financial institutions to prepare for a rise in vulnerabilities (TechCrunch).

Our view The link between GMO and Artex is unconfirmed, but the report that AI-driven intrusion tools are being used against Japanese companies is itself a warning for small businesses. Once the laborious job of hunting for weak settings is automated, whether a company gets targeted depends less on its size than on gaps in the basics, such as missing multi-factor authentication and reused passwords. A company that leaves those gaps open can lose accounts and customer data within hours of an attack starting. What is needed is not an expensive product but a check that multi-factor authentication is switched on for every account.

4. What small businesses should check now

If you use Onamae.com Desktop Cloud, check GMO's latest notices (report 12 onward) on its own page, and do not open links in emails or texts. GMO says it never asks for passwords or authentication codes
Tell everyone today that no one should open the attacker's site, or sites that summarise it, 'just to check'. Anyone who has opened it should run a full scan with security software
Check whether passwords for trading accounts, cloud services or email are stored inside a VPS or shared PC, and change them if so
List which accounts have multi-factor authentication switched on, and enable it on the rest, one by one
Decide who will answer, and with what material, when a customer or supplier asks whether this incident affects you

Our outlook

Over the next six months to two years, we expect it to become unremarkable for a victim company to tell its users not to look and to switch off their machines, and to offer a bounty to find the attacker. The faster AI speeds up the groundwork for intrusion, the more often an incident at a service you rely on will turn directly into harm to your own customers. Customers and suppliers will start asking even small companies, in writing, where they keep what and who acts how when something goes wrong. In the same period, using AI to find and compare suppliers will spread, and companies that cannot show they are safe will be dropped at the comparison stage. The companies that first list where their data is held, switch on multi-factor authentication everywhere and set an incident contact procedure will keep being chosen by both customers and their AI agents. Now is the time to lay that groundwork.

Questions this article answers

Is it safe to open the site the GMO attacker published, just to check?

Please do not. GMO says it has confirmed that information about visitors to the published site is captured by the attacker, and asks people not to visit it, repost it or share it on social media. If you have already opened it, run a full scan of the PC with security software.

How should we handle scam emails that piggyback on the Onamae.com Desktop Cloud incident?

Do not open links or attachments in emails or texts; check the content on GMO's official page. GMO says it never asks for passwords or authentication codes, and warns people not to respond to contacts that demand payment, such as an offer to recover lost money.

What should a small company do first to avoid a similar incident?

Check whether passwords for trading accounts and cloud services are stored on servers or PCs, and enable multi-factor authentication on every account. Reports describe cases where AI-driven intrusion tools exploited basic weaknesses such as missing multi-factor authentication.

Sources

Related Q&A

Related services

If you want to try this in your own business

To see how the topics in this article would apply to your own operations, and what it would cost, send us a message through the contact form.