Japan's GMO Internet Group Faces Daily Leak Threats After Refusing Ransom, Purported Customer Data Appears Online

Japan's GMO Internet Group told NHK on Tuesday it would not pay a $1 million (£752,245) ransom as hackers released purported customer details and threatened further daily disclosures.

The refusal followed a breach of its Onamae.com Desktop Cloud service, which provides virtual desktops for financial traders.

GMO had reported the previous week that cloud servers mainly employed for currency trading had been accessed without authorisation and that illicit transactions had occurred on some customer accounts.

GMO Internet Group Rejects the Ransom Demand

The group claiming responsibility for the attack had set a deadline of 12pm on Tuesday, Japan time. It threatened to publish customer details every day at 12pm unless payment arrived.

GMO confirmed it was working with police and other authorities. The published material has not been authenticated, and the company is still assessing the extent of the incident.

A timeline published by TechCrunch records a much larger initial demand on 21 October, when hackers emailed GMO seeking about $50 million (£37,611,945), or approximately ¥8 billion.

Mounting Losses for a GMO Internet Group Customer

One woman reported that repeated unauthorised transactions over two days the previous week had cost her more than $11,000 (£8,275), or about ¥1.8 million. She described losses that were still mounting, alongside concern that hackers could carry out their threat to encrypt customers' devices.

'I'm just an amateur, while they're a group of hackers who are incredibly knowledgeable about networks. So I'm worried that they could easily bypass the measures I've taken.'

In response, she had backed up her data and reset her computer. She had also updated passwords for several of her accounts. Yet those precautions had brought little reassurance about whether she could prevent further harm.

'I'm just doing what the company advises me. But I'm worried if that's really enough to be safe. It's scary.'

The threat extended beyond money. The woman described constant anxiety over the group's claim that it would send her browsing history and other information to relatives and acquaintances.

GMO Internet Group Investigates the Extent of the Breach

The company estimated that 27,000 servers might be affected. The figure does not establish how many customers' details have been exposed.

GMO shut down its Onamae.com Desktop Cloud on 21 October after discovering unauthorised access, then reported the incident to Japanese police on 22 October. It announced on 24 October that it would offer compensation and an alternative service while seeking assistance from government agencies.

On 25 and 26 October, the company began collecting customers' devices to detect malware and assess the damage. It has also advised customers to reset passwords following reports of unauthorised activity on trading accounts.

On 27 October, GMO reported that a suspected attacker had published information apparently connected to the company and its customers. In its blog update, the company indicated that information relating to its business might also be involved.

The woman wanted GMO to explain exactly what had happened and what the situation was now.

On Wednesday, 28 October, GMO said the domain used to publish the purported information had been taken down at approximately 4am Japan time. It warned that replacement sites could still emerge and said it would seek their removal.