Japanese ISP GMO Internet has notified customers that its desktop cloud service, Onamae.com Desktop Cloud, which is positioned as a suitable platform for foreign exchange trading, has been compromised by an attacker.
The firm disclosed last week that "a third party had installed malicious programs in the server environments of some customers." This situation is particularly concerning given that the servers host virtual Windows desktops recommended by GMO for foreign exchange trading applications.
Subsequent updates revealed that some patrons reported "unauthorized operations were performed on their trading accounts," leading to the advice that third parties likely viewed users' trading service passwords. The following day, the company urged users to immediately alter passwords for their trading accounts, stipulating that this must be done using a device not utilized for trading.
GMO has since acknowledged that its Onamae.com Desktop Cloud service possessed "security vulnerabilities, that its environment was accessed without authorization, and that customer information was taken outside the Company." Furthermore, "Some customers have also reported transactions in their trading accounts that they do not recognize."
Due to these suspicious transactions, GMO contacted major trading services, requesting they forcibly terminate all active sessions, monitor for unauthorized activity, and block trade requests originating from Onamae.com Desktop Cloud.
The organization stated it has "received a demand for money from a person believed to be the attacker," noting that refusal would result in the attacker taking actions such as publishing information about the Company and its clientele. The demanded sum is $50 million, but the company will not comply, stating that "complying would not guarantee that the obtained information is deleted or that its misuse is prevented."
Investigations are ongoing, with GMO warning that 26,739 VDI servers might have been affected, placing users' personal devices at risk. The company is providing all users with a ¥5,000 ($32) condolence payment and has promised to cover any trading losses resulting from the incident.
GMO CEO Masatoshi Kumagai stated that the ¥5,000 is "a token of our initial sincerity towards our customers who have experienced inconvenience and worry." He further committed that "We will dedicate the full resources of our group to providing a free alternative environment for six months, fundamentally overhauling our system infrastructure, and conducting a thorough investigation into the cause and preventing recurrence with the help of external experts."
Kumagai admitted that GMO was aware the service's security required enhancement, noting that "Our in-house white-hat hackers had previously pointed out areas for improvement to the team." However, he conceded, "our response lacked sufficient depth and speed, allowing the attackers to exploit the vulnerability."
This incident highlights the escalating threat landscape, as Kumagai noted that "The ease with which open weight AI models can be combined and spread into countless attack tools has transformed cyberattacks, which once required advanced skills, into an era where anyone can easily carry them out." He also mentioned that GMO Group’s cybersecurity operation "has confirmed that the source of an unauthorized access attack targeting approximately 20 Japanese companies was the misuse of ‘ARTEX,’ an autonomous AI penetration testing tool originally intended for defense."
