GMO Internet says hackers posted data stolen from its Onamae cloud desktops

It is a service run by GMO Internet, one of Japan's largest domain registrars. A domain registrar is a company that sells website addresses.

What it does: BleepingComputer describes it as a VPS service. A VPS, or virtual private server, is a computer you rent in a data center and control over the internet.

Who uses it: TechCrunch says it provides virtual desktops to financial traders. BleepingComputer says it is advertised for stable automated currency trading, including running the MetaTrader 4 program around the clock.

Why it matters: customers leave trading programs running on these servers, so logins for trading accounts may sit on the machines too.

The timeline comes from TechCrunch, BleepingComputer and the Japanese outlet ASCII.jp.

• October 19: GMO began investigating after inquiries from users, according to ASCII.jp.
• October 20: the company confirmed that an unauthorized third party had installed "malicious programs" in some customers' server environments, BleepingComputer reports.
• October 21: GMO shut down all Desktop Cloud servers starting at 4 a.m. local time. It also got an email from the attackers demanding about 8 billion yen, TechCrunch says.
• October 22: GMO reported the incident to police. It also said customers had reported unauthorized operations on their trading accounts.
• October 24: GMO said it would offer compensation and an alternative service, and seek help from government agencies.
• October 25 and 26: the company began collecting devices from customers to look for malware. On October 26 it warned that the attackers planned to leak customer data and trigger ransomware planted on customer servers.
• October 27: GMO said a suspected attacker had posted information that appeared linked to the company and its customers.

Ransomware is malicious software that locks or damages a computer until the victim pays. BleepingComputer says GMO warned that the attackers planned to set off a ransomware payload placed on customer servers earlier in the attack.

The warning: on October 27, GMO asked customers to back up their data, disconnect from the internet, shut down their computers and unplug all cables before noon.

What happened next: BleepingComputer says the attacker appears never to have acted on the threat, because no ransomware was activated on customer machines.

The ransom: the attacker asked for about 8 billion yen, roughly $50 million. GMO says it will not pay.

Not everything is clear yet.

TechCrunch says GMO believes the attacker published information allegedly linked to customers and the business. The contents are still being checked, and the full extent is unclear. BleepingComputer says GMO later confirmed that data belonging to both the company and its customers had been published.

GMO has said payment information, such as credit card details, was not exposed. It says that data is stored on different infrastructure.

The catch: GMO says logins for MetaTrader 4 and MetaTrader 5 and trading-account details may have been exposed or misused. An attacker with those logins could place trades.

GMO's advice is practical, and it comes from the company and the outlets that quote it.

• Change passwords: reset passwords for trading tools and trading accounts. Do it from a device other than the affected server, then log off, ASCII.jp reports.
• Check your account: look at transaction history and balances, and contact your trading provider about anything unfamiliar.
• Rotate secrets: BleepingComputer says anyone who stored passwords or similar secrets on the servers should change them quickly.
• Watch for phishing: phishing means fake messages that trick you into giving up passwords. GMO says it will never ask for a password or credit card number by email or phone.

Trading firms moved too. ASCII.jp reports that OANDA Securities asked customers to change trading-account passwords, use two-factor authentication and review their history. AI Gold Securities said it was strengthening its monitoring for unauthorized logins, trades and withdrawals.

Compensation: GMO says it will pay each customer 5,000 yen, about $30, for the inconvenience. It will consider more for people whose information was exposed.

Recovery: BleepingComputer says GMO is working with Trend Micro to recover. It is scanning customer systems for leftover malware and offering equivalent PC replacements to customers harmed by a ransomware attack.

Legal action: GMO asked people and the media not to spread the leaked information. It says it will take legal action against those who do.

Maybe, but nobody has said so. About a week earlier, GMO's cybersecurity unit reported evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks on companies across Japan. A penetration testing tool is software that security teams use to probe systems for weak spots.

What GMO says: TechCrunch reports that the company has not publicly established a link between Artex and the Onamae breach.

The wider picture: TechCrunch says Artex was also used against South Korean financial institutions in September, according to a CrowdStrike report. The attacks largely relied on weak security, such as a missing second login step called multi-factor authentication. Reuters reported that the tool's developer stopped public updates and closed the source code after it was tied to attacks on banks.

Japan's Financial Services Agency told TechCrunch it issued guidance in May urging financial firms to prepare for more vulnerabilities. It called for stronger basic defenses, including vulnerability management, layered protection and incident preparedness.

Several important answers are missing, and the sources we read say so.

• Is the leaked data real? GMO is still verifying it. TechCrunch says the full extent of the incident remains unclear.
• How did the attacker get in? The company has not explained it in the reports we read.
• How many customers lost money? GMO and ASCII.jp say some customers reported unauthorized operations on their trading accounts. No total has been given.
• When will the service return? BleepingComputer says no restart date has been provided for the Desktop Cloud plans.

TechCrunch also says a GMO spokesperson did not answer its request for comment. We will update this story when the company shares more.

• If you use Onamae Desktop Cloud: change your trading-tool and trading-account passwords from another device, log out and check your account history.
• If you trade through a firm like OANDA: turn on two-factor authentication and read their notices.
• If you get an email about the breach: treat it with suspicion. GMO says it will never ask for your password by email or phone.
• If you run your own cloud server: keep secrets such as passwords out of it where you can, and use two-factor login.