GMO Internet Group

Summary

GMO Internet Group disclosed that an intrusion into its Onamae Desktop Cloud service potentially exposed malware on up to 26,739 customer servers, leading the provider to shut down systems and reduce availability while investigating with Trend Micro. The breach compromised MetaTrader 4 and MetaTrader 5 credentials and trading-account details, though payment information remained secure, and the attacker demanded an 8 billion yen ransom that the company refused to pay before customer and corporate data was published online. Although the threat actor warned of a ransomware payload and data leak, no ransomware was ultimately activated on customer machines, and the firm offered each affected customer 5,000 yen in compensation while promising additional payments and legal action against those sharing the leaked information.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

GMO Internet Group detected an intrusion on October 20 affecting Onamae Desktop Cloud, a virtual private server provider operated by GMO Internet and used by up to 26,739 customers. The company determined that malware could have been installed on customer servers and responded by shutting down the servers and reducing service availability before beginning an investigation. Officials stated that payment information had not been exposed but warned that MetaTrader 4 and MetaTrader 5 credentials and trading-account details may have been compromised, leading the company to urge customers to reset passwords and terminate active sessions. Subsequent updates confirmed that data had been stolen and that the threat actor was demanding a ransom of 8 billion yen, approximately 50 million dollars. GMO stated that it would not pay the attackers and instead announced compensation of 5,000 yen, about 30 dollars, for each customer affected by the inconvenience. On October 26, the company warned that threat actors intended to leak customer information online and activate a ransomware payload that had been planted on customer servers earlier in the intrusion. The following day, GMO asked customers to disconnect their personal computers from the internet, shut them down, and unplug all cables before noon while the company worked with Trend Micro to recover from the cyberattack. The company advised customers to back up data first, then disconnect the network, power down, and remove the cable connecting the PC. GMO also began scanning customer systems to determine whether malware remained present and offered equivalent PC replacements to customers who suffered damages from a ransomware attack.

In a report published on October 27, GMO confirmed that the threat actor had published company and customer data online, prompting efforts to verify the authenticity of the leaked information. The company stated that it would consider additional financial compensation for customers whose information was exposed. Despite the earlier warning, no ransomware was activated on customer machines, meaning the attacker did not carry out the threatened payload. GMO warned individuals and media outlets not to disseminate the exposed information and announced it would take legal action against those who did. The company reaffirmed its refusal to pay the attackers while continuing recovery efforts with external security partners.

Sources

Sources available to members: 1 source.