GMO Internet confirms data breach after hackers publish stolen customer information

Japan's GMO Internet is grappling with a significant data breach affecting its Onamae cloud desktop service, a platform used by financial traders to access virtualized work environments. The company announced that threat actors have publicly released information tied to both the firm and its customers, though verification of the leaked data is still ongoing.

The Breach and Response#

GMO Internet discovered unauthorized access to its systems on October 21 and immediately suspended Onamae's operations. The attackers sent the company an extortion message demanding approximately 8 billion yen (roughly $50 million). The breach potentially compromised 27,000 servers, and the company has since urged customers to change their passwords after learning of suspicious activities on trading accounts.

The firm reported the incident to Japanese authorities and has begun collecting customer devices to scan for malware and assess the full scope of the damage. GMO Internet is also providing affected users with compensation and access to alternative services.

Potential Connection to Chinese Hacking Tool#

While GMO has not formally linked the breach to any specific threat group or technique, the timing raises questions about Artex, a Chinese AI-enabled penetration testing tool that GMO's own cybersecurity division recently documented being deployed against Japanese firms. The same tool was used to target South Korean financial institutions in September, typically exploiting basic security gaps—particularly the absence of multi-factor authentication.

Following the Korean attacks, Artex's developers in China halted public development and converted the tool to closed-source to limit its misuse.

Regulatory Push for Stronger Defenses#

Japan's Financial Service Agency said it issued guidance in May calling on financial institutions to strengthen their cybersecurity posture. The regulator emphasized foundational measures including vulnerability scanning, layered defenses, and contingency planning, while also encouraging adoption of AI-driven security solutions.

The GMO incident underscores persistent vulnerabilities across Japan's financial sector, particularly among firms managing trading platforms and customer financial data.