cyber.hendryadrian.com
Security News · thehackernews.com

GMO Offers $1 Million Bounty After Onamae.com Desktop Cloud Breach

· Original article ↗

Summary

GMO is offering up to $1 million for tips leading to an arrest or international wanted notice after confirming unauthorized access to its Desktop Cloud service and customer-information exfiltration. The entry method and full impact remain unclear.

Key points

  • GMO's bounty program offers up to $1 million for tips that lead to an arrest or international wanted notice; the company will share tips with authorities.
  • GMO confirmed unauthorized access to Desktop Cloud and exfiltration of customer information. It found malicious programs on some customer servers and shut down servers across all plans.
  • GMO counts 26,739 servers as potentially affected; that figure does not represent confirmed break-ins or data thefts.
  • OANDA Japan confirmed that a third party logged in to and traded on some customer accounts using credentials it believes were leaked from GMO servers. As of October 26, it had found no breach of its core systems.
  • GMO received an extortion demand of about $50 million. Attackers claimed to have posted customer information, but the amount published and the impact remain under review.
  • GMO had not confirmed how the attackers gained access. Claims by the attackers about a shared administrator account and a service flaw were also unconfirmed.
  • No ransomware attack had been confirmed as of October 27. GMO had found no malware on the customer PCs it had completed checking, but analysis was ongoing.

Article Details

Event Type
Cybersecurity breach involving extortion and a public bounty for information leading to the attackers’ arrest
Impact
GMO confirmed unauthorized access to its Onamae.com Desktop Cloud service and exfiltration of customer information. It identified 26,739 servers as potentially affected, not as confirmed break-ins or data thefts, and shut down servers across all plans. A broker confirmed third-party access to and trading on some customer accounts using credentials it believes were leaked from GMO servers. The attackers demanded about $50 million and threatened further account manipulation, data publication, and ransomware; no ransomware attack had been confirmed as of October 27. The extent of published information and the number of customers eligible for compensation remained unconfirmed.

MITRE ATT&CK

T1078 · Valid AccountsA broker confirmed that a third party logged in to and traded on some customer accounts using ID and password pairs it believes were leaked from GMO servers.

People

Masatoshi KumagaiHeads GMO Internet Group and wrote that the group's white-hat hackers had warned the service team about problems in advance; he said the response was not fast or thorough enough.

Vendors

GMO InternetJapan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand.

Products

MetaTrader 4Anything customers stored on the servers may have been viewed, including login credentials saved in trading software such as MetaTrader 4 and 5 (MT4/MT5). GMO does not keep customers' payment card data on the servers.Onamae.com Desktop CloudJapan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand.

Countries

JapanJapan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand.

Related Articles