KR — ZDNet Korea
GMO Internet Group FX Auto-Trading Server Hacked; ¥5,000 Consolation Payment Offered to All Users
Security2 min read
GMO Internet Group, a big Japanese internet company, was hacked. Its servers for automatic currency trading were broken into, and customers lost money. GMO asked the Japanese government for help fighting the attackers, and it will pay every customer a small apology gift.
What happened
Hackers broke into servers used for automatic foreign exchange (FX) trading. These servers stored login details for customers' trading accounts, and the hackers stole them. Criminals then made unauthorized trades in accounts at more than 70 securities firms and FX companies in Japan and abroad. GMO asked the government to use "active cyber defense," which means the government would act against attacks before they cause harm. The Japanese government has not yet decided to do so.
Key numbers and facts
- More than 20,000 people used the hacked service, called Onamae.com Desktop Cloud.
- Unauthorized trades may have happened at more than 70 securities firms and FX companies.
- One man in Hiroshima, age 60s, saw his FX balance drop from 4 million yen to about 1.6 million yen. The loss took only 84 seconds across 48 trades.
- A woman in Osaka, age 37, lost 1.19 million yen in one trade. Her total loss grew to 1.78 million yen.
- GMO will pay every customer 5,000 yen, even if they were not harmed. Customers who want it can get a replacement service free for six months.
Background
Automatic trading lets a person connect a trading program to a brokerage account, so trades happen without the person watching. A virtual private server (VPS) is a rented computer on the internet that runs these programs. GMO found the problem after customers asked about it on the 19th. It found malicious software on the server on the 20th and began shutting servers down on the morning of the 21st. The attackers demanded money. They threatened more unauthorized trades, leaks of customer data, and ransomware attacks if GMO did not pay. GMO refused, because paying would not guarantee that the data would be deleted or misuse would stop. It is working with the police.
Why it matters
This case shows how hard it is for one company to stop cyber criminals who work across borders. GMO says that private companies acting alone cannot stop large criminal groups from taking people's money. The government must now decide whether this case qualifies for active cyber defense, which is meant for serious harm to key infrastructure. Customers who were hit may have to wait for the total damage to be counted, because they need records from securities firms and FX companies.
What to watch
- Whether the Japanese government decides that GMO's case qualifies for active cyber defense.
- How many customers apply for compensation, and how much total loss is counted.
- Whether the attackers carry out their threats to leak data or launch ransomware.
- Whether the police find the attackers.
Glossary
- FX
- Foreign exchange trading, where people buy and sell different currencies to try to make money.