Japanese internet company GMO Internet is investigating a data breach following suspected unauthorized access to its cloud desktop service Onamae, which provides virtualized desktops to financial traders.
The IT and internet services giant said in a blog post that it believes the attackers exposed information purportedly related to customers and their businesses. However, the details are still being verified and the full details of the incident have not yet been revealed.
GMO Internet has since advised customers to reset their passwords after receiving reports of “unauthorized manipulation” of their trading accounts. The company said 27,000 servers could be affected by the breach.
A spokesperson for GMO Internet did not respond to TechCrunch’s request for comment.
The incident occurred about a week after the Japanese company’s cybersecurity division separately reported that it had found evidence that a Chinese AI-enabled penetration testing tool called Artex was used in hacks targeting companies across Japan. However, the company said it has not publicly established a link between Artex and Onamae’s infringement.
According to a CrowdStrike report earlier this month, Artex tools were also used to hack a South Korean financial institution in September. The attack primarily relied on exploiting weak security controls, such as the lack of multi-factor authentication. The Chinese developer of Artex has stopped public updates and closed sourced its AI security tool after it was linked to a cyberattack targeting banks, Reuters reported.
A spokesperson for Japan’s Financial Services Agency (FSA) told TechCrunch that it issued guidance in May urging financial institutions to prepare for an increase in cybersecurity vulnerabilities.
The spokesperson added that regulators are pushing for stronger basic defenses such as “vulnerability management, layered defenses and incident preparedness” and are encouraging companies to use AI and other security tools.
This is the timeline of Onamae infringement.
October 21st: GMO Internet suspends its “Name Desktop Cloud” service after unauthorized access to its system was discovered. The IT company also received an email from the hacker demanding approximately 8 billion yen (approximately $50 million).
October 22: The Japanese company reported the incident to Japanese police and shared another official update.
October 24: GMO Internet announced it would provide compensation and alternative services to customers while seeking support from government agencies.
October 25-26: The company detected malware and began recalling devices from customers to better understand the damage.
October 27: A Japanese IT company announced that a suspected attacker posted information believed to be related to the company and its customers. GMO said it is still verifying the authenticity of the information.
If you make a purchase through links in our articles, we may earn a small commission. This does not affect editorial independence.
