GMO Internet has switched off every plan of its Onamae.com Desktop Cloud service after a third party planted malicious programs in some customers' server environments. The company says trading-account login details stored on those servers may have been obtained and misused. No restart date has been set.
What the company confirmed
GMO Internet began investigating on 19 October after a customer inquiry. On 20 October it confirmed that unauthorized programs were present on some customers' servers, and the same day it stopped new applications and the control panel. From 4am on 21 October it shut down servers across all plans in sequence to limit the damage. It consulted police on 22 October.
The notice says investigation and customer reports indicate that login information for trading accounts, stored on the servers, may have been taken and used without authorization. Whether any individual's data was actually taken or misused, and how far that went, is still under investigation.
Scale and what is exposed
As of 4:10pm on 23 October, GMO Internet put the number of potentially affected servers at 26,739. The company stresses that this counts servers that could be in scope, not servers where unauthorized access or data theft has been confirmed.
The potentially affected data is whatever was stored on the servers, including trading-account logins saved in trading tools. GMO Internet says it does not hold customers' payment details, including credit card data, on these servers. Information that customers saved on the servers themselves is within scope.
Response and open questions
GMO Internet says it is working with an outside security firm on the intrusion route and scope, coordinating with related businesses, and reporting to and consulting the authorities. Customers are being asked, as a matter of urgency, to:
- change trading-account and trading-tool credentials from a device not used for trading;
- disconnect all logged-in sessions;
- check trading history and balances;
- set up two-factor authentication.
The company says it cannot yet calculate the effect on consolidated results and will announce a forecast revision or any newly identified disclosable fact promptly. The intrusion route is still under investigation, and the date service will return is undecided.
The parent, GMO internet group, issued its own notice the same day, describing the incident as one at a consolidated subsidiary and repeating the subsidiary's figures and timeline. It also says the effect on its own consolidated results is under review and cannot yet be calculated.