EXPLORINEER
en

JP — ITmedia

GMO Confirms Attacker Published Information; Investigating Whether Customer Data Is Included, Considering Additional Condolence Payments

Security2 min read

GMO Internet Group says someone who appears to be the attacker has released what looks like customer data from its FX trading VPS service. The company is still checking whether the data is real and whether it includes customer information.

What happened

On October 27, GMO Internet Group said it saw data that seems to be customer information posted online at 12:30 p.m. The posting came from a person who may be the attacker. The attacker had said it would carry out a ransomware attack (a type of attack that locks files and demands money) at noon and publish customer data. As of 1:55 p.m., the company had not confirmed the ransomware attack. The company warned that some of the posted data may be false.

Key numbers and facts

  • Data was seen online at 12:30 p.m. on October 27, 2026.
  • The attacker first asked for $50 million (about 8 billion yen) by 5 p.m. on October 21.
  • Later, the attacker asked for $1 million (about 160 million yen) by noon on October 27.
  • GMO already paid a 5,000 yen apology payment to each user, announced on October 24.
  • GMO is considering extra apology payments for users whose data was posted.

Background

The problem started with unauthorized access to 'Onamae.com Desktop Cloud,' a virtual private server (VPS, a rented computer that runs in a data center) used for automated FX trading. GMO shut down all server plans on October 21. Users reported money losses, so GMO agreed to cover losses from unauthorized trades. GMO's CEO, Masatoshi Kumagai, said on his blog that the company would not pay the ransom.

Why it matters

This case shows how a hack can harm both private data and people's savings. Users may face more risk if their personal information is shared. GMO also says people who visit the posted site may have their information taken by the attacker, so it asks people not to visit the site or share the data. Legal action is being prepared against people who spread the data in harmful ways.

What to watch

  • Whether the posted data is real and how much personal information it includes.
  • Whether GMO contacts affected people one by one.
  • How much the extra apology payment will be, which is still undecided.
  • Whether the ransomware attack actually happens.
  • What legal steps GMO takes against people who spread the data.

Glossary

VPS
Virtual private server: a rented part of a big computer that acts like its own server.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

Security전자신문

[AI Guarding AI] Microsoft Extends Project Perception to Protect Internal AI Agents, Not Just External Threats

Microsoft says AI security must now cover internal AI agents that access enterprise data, tools, and systems, not only external AI-powered attacks. Its Project Perception, unveiled in July, combines signals, security context, models, and specialized Red, Blue, and Green agents into a continuously learning defense system, with humans retaining final control over key decisions. The company also describes "agentic insiders," offers layered protection and dynamic risk scoring, and provides traceability so security teams can monitor agent behavior and adjust policies.

SecurityITmedia

Times Car Asks How the ¥3,000 Apology Payment Was Calculated; Park24 Responds

Park24, the operator of the car-sharing service Times Car, told ITmedia NEWS on October 27 that the ¥3,000-equivalent apology payment to affected users was set by comprehensively weighing the response options available to users and the burdens involved, though it declined to disclose the specific calculation basis. The company said the payment will be made as cash or vouchers, but the form and payment timing are still under consideration, and details will be announced once decided. The payment covers 1,464,349... (see note) affected records, and the company expects to book a ¥5.5 billion special loss for the payment and related response costs.

Security전자신문

[AI Against AI] Piolink: From AI-Driven Vulnerability Verification to Blocking Hacks

As AI-driven hacking automates vulnerability discovery, attack-path design, and intrusion attempts, enterprise security teams face growing pressure. Piolink proposes a multi-layered defense: its agentic AI-based CTEM platform "BlueHunter" verifies real exploitability to set priorities, its web firewall "WebFront-K" blocks automated attacks in real time, and 24-hour security monitoring tracks attack continuity. The company said BlueHunter found 28 undisclosed vulnerabilities in 10 Linux open-source services and one CMS, with two assigned CVE numbers and disclosure planned for December.

SecurityITmedia

GMO to Provide New PCs to Customers Hit by Ransomware; Criminal Group Reportedly Publishes One Customer's Data

GMO Internet Group announced it will provide replacement PCs with equivalent performance to customers whose PCs were hit by ransomware through unauthorized access to "お名前.com デスクトップクラウド." The company said that as of 11:59 a.m. on October 27, no ransomware or other malware had been confirmed on devices already collected and analyzed, while the criminal group published what it claimed was one customer's personal information, which GMO said may contain inaccurate content and urged people not to access or spread it.