What Happened to GMO’s 26,739 Cloud Servers?
GMO began investigating on October 19 after receiving a customer inquiry and confirmed the following day that malicious software had been installed in some customer server environments.The company began shutting down all Onamae.com Desktop Cloud plans from 4 a.m. Japan time on October 21 to contain the incident. It identified 26,739 servers as potentially affected, although that figure represents server environments that may have been exposed rather than 26,739 confirmed compromises.FinanceFeeds previously reported that the GMO breach prompted OANDA Securities Japan to delay some customer withdrawals while additional security checks were conducted.The affected cloud service is used by traders to operate software including MetaTrader 4 and MetaTrader 5 continuously on remote machines. Login credentials and other account information stored inside those environments may therefore have been accessible to the attackers.GMO subsequently confirmed that customer information had been removed from its systems and said customers had reported unauthorized transactions in their trading accounts.
Investor Takeaway
Did the Attackers Carry Out Their Threats?
The attackers threatened to publish customer information and conduct ransomware attacks if GMO refused to pay. They also threatened further unauthorized activity involving trading accounts connected to more than 70 securities and FX firms in Japan and overseas.Those claims should not be interpreted as evidence that all of those brokers were compromised. They were threats attributed to the attackers.By 12:30 p.m. on October 27, GMO had confirmed that information claimed to belong to the company and its customers had been published online. The company began reviewing the material and said it would contact customers individually where exposure was confirmed.GMO also asked customers to avoid visiting or circulating the attackers’ site, warning that the attackers could collect information about visitors. By approximately 4 a.m. on October 28, GMO said the domain hosting the material had been taken down.Importantly, the threatened ransomware attack has not been confirmed. GMO’s latest analysis of customer devices found no evidence of malware infection or ransomware activity on the machines examined so far, although the investigation remains ongoing.
How Much Could GMO Have to Pay Customers?
The direct financial cost of the incident remains uncertain. GMO has committed to compensate customers for realized losses caused by unauthorized trading that its investigation confirms resulted from the breach.FinanceFeeds reported one case in which a Japanese FX trader alleged approximately ¥1.8 million in losses from unauthorized transactions. Another customer reportedly suffered losses of about ¥550,000.Those cases establish that some customers experienced financial damage but do not provide a reliable estimate of GMO’s total liability. The company has not disclosed the number of valid compensation claims or an aggregate loss figure.GMO will also pay ¥5,000 to every current Onamae.com Desktop Cloud customer regardless of whether they experienced unauthorized trading. The goodwill payment is separate from compensation for confirmed direct trading losses.The wider effects have reached individual brokers. AvaTrade Japan confirmed unauthorized access and transactions involving some customer accounts after warning customers who used external services, including VPS providers. However, a direct technical connection between every affected AvaTrade account and GMO’s infrastructure has not been established.
Investor Takeaway
Why Did GMO Refuse the Crypto Ransom?
GMO said paying the attackers would not guarantee deletion of the stolen information or prevent its subsequent misuse. The company instead referred the matter to police and relevant authorities and began pursuing the attackers through legal, technical and investigative measures.On October 28, GMO escalated that response by creating a cybercrime reward program offering up to $1 million for information that could help identify and apprehend those responsible. Within six hours of launching the program, the company said it had received 113 submissions.The distinction between the attackers’ alleged $1 million reduced ransom and GMO’s new $1 million reward is important. The reward is being offered by GMO for information about the perpetrators; it is not a payment to the attackers.The incident also demonstrates how a breach of third-party trading infrastructure can spread financial risk beyond the technology provider itself. Compromised VPS credentials can potentially provide access to brokerage accounts even when a broker’s own systems have not been breached.For GMO, the investigation is therefore no longer primarily about whether to pay an extortion demand. The larger questions are the number of customers whose information was exposed, the scale of unauthorized trading losses, the cost of compensation and when the affected cloud service can safely return to normal operation.
