EXPLORINEER
en

JP — ITmedia

Who Is Responsible at the Embattled GMO Press Conference? CEO Kumagai Describes the "Power Dynamics Within the Group"

Security2 min read

GMO Internet Group held a press conference on November 2 after an unauthorized access attack on its FX trading cloud server service. Reporters pressed the company on why it did not fix a security flaw flagged in 2024, and on CEO Masatoshi Kumagai's social media posts.

What happened

GMO Internet Group held a press conference on November 2, 2026. It was about an unauthorized access attack on 'Onamae.com Desktop Cloud,' a virtual server (VPS) used for automatic FX (currency) trading. Reporters asked why the group did not act fast on a security weakness that its group company, GMO Cybersecurity by Ierae, reported in 2024. They also asked about posts by CEO Masatoshi Kumagai on social media (SNS).

Key facts

  • GMO Internet made 4 emergency maintenance fixes after the 2024 warning, but these did not solve the problem.
  • The 2024 warning was known to GMO Internet CEO Masatoshi Ito and Vice President Hiroshi Yamashita, but not to Kumagai, who said he learned of it from this incident.
  • Kumagai said he has been at the company for 31 years and has never said 'making money' is the goal.
  • Kumagai said he will stop posting on social media for a set period, after a final post that sums up the press conference.

Why the warning was not acted on

The company said the warning from GMO Cybersecurity by Ierae did not get enough weight inside the group. Kumagai said a new group company finds it hard to have a voice at first. Its influence grows as it builds trust. He said the company's view now carries weight in the group. Kumagai also said the attacker's claim that they reported the flaw many times, with no reply, is a lie meant to hurt the company's reputation. He said he would fire any staff member who had ignored a real report.

Why it matters

The story shows how a company's internal power structure can slow down security fixes. It also shows how a CEO's public posts can hurt trust during a crisis. Customers whose data or accounts were affected are waiting for clear answers and real fixes. Kumagai also said he wants a plan called 'Cyber Aegis,' which would require telecom firms to block harmful IP addresses quickly. That would need new laws, and it raises questions about the privacy of communications.

What to watch

  • Whether GMO explains the exact cause of the delayed fix, which it said it will investigate later.
  • Whether Kumagai resigns. He has ruled this out for now, but would not say whether he would step down once customers are made whole.
  • How Kumagai's social media silence is handled, and whether he posts again if the attacker makes new moves.
  • Whether the government responds to Kumagai's Cyber Aegis proposal.

Glossary

VPS
Virtual Private Server: a rented virtual computer on the internet, used to run software for a customer.
GMO Cybersecurity by Ierae
A security company in the GMO Internet Group that checks systems for weak spots.
Cyber Aegis
Kumagai's plan for quickly blocking harmful IP addresses that attacks come from, with help from telecom companies.

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityThe Register

Max-severity bug in widely used OT programming tool exploited to deliver Linux malware

Unknown criminals are exploiting a maximum-severity vulnerability, CVE-2026-58115, in Node-RED, a flow-based programming tool widely used in industrial control and operational technology environments, to deploy a flow that downloads and runs a Linux bot. Siemens rated the bug 10 out of 10 on CVSS, and affected devices such as the SIMATIC IoT2050 do not enforce authentication on the Node-RED HTTP interface. VulnCheck researchers said the activity came from a single IP address and observed the exploit first on October 30, 2026.

Securityheise online

IT attacks with data leaks at notebooksbilliger and Pÿur

Online retailer notebooksbilliger.de and internet service provider Pÿur (formerly known as Tele Columbus) have emailed customers about attacks on their corporate IT, and personal data may have fallen into the wrong hands. notebooksbilliger says IBAN account numbers may have been taken, that passwords and full credit card numbers are not affected, and that a mid-five-figure number of customers may be impacted. Pÿur reports that customer contract numbers, names and account data were likely also exfiltrated in an IT incident between mid-September and early October 2026.

SecurityThe Register

Cops bust botnet of 1.3M infected Android TV boxes

A coalition of security firms working with Japan's National Police Agency disrupted XCPE, a backdoor used to build a botnet of more than 1.3 million Android devices across over 200 countries. Google says Shenzhen-based hardware maker Videostrong Technology deliberately embedded the backdoor in device firmware and sold access to criminal affiliates. The disruption also took down command-and-control domains used to manage affiliate malware modules, which Google says could sever access to at least 10 million more compromised devices.

SecurityTechCrunch

Germany says lawmakers’ iPhones may have been hacked with spyware

Germany's federal cybersecurity office, the BSI, says members of the Bundestag and other unnamed notable people received Apple threat notifications warning their iPhones may have been targeted by government-backed spyware. Apple does not attribute attacks to specific governments or confirm that devices were compromised, so the BSI advises recipients to assume their devices may have been compromised. Apple said the latest batch of notifications went out to users in 99 countries.