GMO seeks Japan cyber intervention after breach prompts unauthorized FX trades

GMO Internet Group said on October 24 that an intruder accessed its Onamae.com Desktop Cloud service, took customer information outside the environment and was linked to transactions that some customers said they did not authorize. An earlier company update said up to 26,739 servers may have been affected and that trading credentials stored on them may have been exposed.

The company said a person believed to be the attacker demanded money and threatened further unauthorized orders through accounts at more than 70 securities and foreign-exchange firms, data disclosure and a ransomware attack. GMO said it would not comply, would compensate verified realized losses from unauthorized trades, and had asked Japanese authorities to trace, block and neutralize the attacker’s infrastructure under the country’s active cyber defense framework.