In a significant cybersecurity incident, a virtual desktop service provider based in Japan, GMO Internet, has issued a concerning advisory to its customers, urging them to disconnect their machines from the internet following a breach by hackers. The Onamae.com service, which is highly regarded in the foreign-exchange trading community, operates through an extensive network composed of tens of thousands of servers managed by GMO Internet.
On October 20, the company made a shocking discovery that “malicious programs” had infiltrated the server environments of certain customers. This revelation led GMO Internet to promptly suspend the Onamae.com service on October 21. The organization’s security alert raised alarms, indicating that sensitive information may have been compromised and that the breach could affect as many as 26,739 servers. Reports have surfaced suggesting that the hackers potentially accessed trading accounts, leading to unauthorized transactions.
Shortly after the breach was uncovered, an extortion email was sent to GMO Internet on October 21, demanding a staggering ransom of around eight billion yen, equivalent to $50.7 million. This demand highlights the serious implications of the cyberattack and its potential consequences for customers and the broader financial sector.
In the wake of the extortion threat, GMO Internet firmly refused to comply with the ransom demand, leading to a chilling notification from the attackers. The hackers warned that they would deploy ransomware on October 27 at 12 PM if their demands were not met. Consequently, the company took immediate action to safeguard its customers, advising them to conduct full virus scans on their devices, back up all data, disconnect their PCs from the internet, and ensure that the devices were powered down.
In a proactive measure to address the situation, GMO Internet has also requested that customers send their PCs to the company’s security team for a thorough investigation. As of the deadline set by the attackers, no malware, including ransomware, was reported to have been detected in the analyzed devices. The company stated, “As of [October 27, 11:59], no malware (including ransomware) has been detected in the devices that have been analyzed.” However, it acknowledged that the analysis process is ongoing and that not all customer devices have yet been examined. The firm anticipates that more devices will be submitted for analysis in the coming days as they continue to assess the security of their systems.
The incident has raised significant concerns about the vulnerabilities inherent in remote access services and the potential for extensive ramifications beyond the initial compromise. Phillip Wylie, chief security evangelist at Suzu Labs, commented, “This demonstrates how a vulnerability in a remote access service can have consequences far beyond the compromised system.” He emphasized that attackers do not necessarily need to deploy ransomware to inflict substantial damage. By stealing sensitive information, compromising user accounts, and threatening the public release of data, malicious actors have various means to exert pressure on organizations.
Wylie further stressed the importance of not just preventing initial breaches but also implementing measures to limit what attackers can achieve once they gain access to systems. “The biggest takeaway is that preventing the initial compromise is important, but limiting what attackers can do once they gain access is equally critical,” he noted.
This breach at GMO Internet is part of a disturbing trend in cybersecurity incidents affecting Japanese companies in recent times. Multiple organizations, ranging from well-known brands to lesser-known firms, have reported major data breaches this year. Notable incidents include breaches at Burger King, impacting approximately 11 million customers; the car rental company Times Car, affecting 6.6 million customers; karaoke giant Daiichi Kosho, where information on eight million users was compromised; and restaurant chain Yakiniku King, also facing a data breach affecting around 11 million individuals.
As the investigation into the breach and the potential implications continues, the urgency surrounding cybersecurity practices and protective measures has never been clearer. The events at GMO Internet underscore the critical need for organizations to enhance their security protocols and ensure robust defenses against evolving cyber threats.