GMO asks Japan to use new cyber defence powers after hack

GMO Internet Group has asked Japan’s government to use its new active cyber defence powers against hackers who breached one of its services. The company made the request on Saturday, after the attackers demanded money.

In a stock exchange filing on Saturday, GMO said it wants state agencies to trace, block, and neutralise the attackers’ infrastructure. It said this would be the first use of the powers, which took effect on 1 October amid a wave of data leaks .

The breach hit Onamae.com Desktop Cloud. The service rents out Windows servers to traders who run automated foreign-exchange tools such as MT4 and MT5 around the clock.

Up to 26,739 servers may have been affected, GMO said in an earlier incident report . The intruders planted malicious software on some customers’ servers, which may have exposed the trading logins stored there. From 21 October, customers reported trades they did not make.

The attackers then demanded payment, according to GMO. They threatened to keep placing unauthorised orders through accounts at more than 70 securities and FX firms in Japan and abroad. They also threatened to leak customer and company data and to launch a ransomware attack.

GMO said it will not pay, because payment would not guarantee the stolen data is deleted or stop its misuse. It has asked police to open a criminal investigation. GMO also warned that anything the attackers publish may be partly false.

GMO has also asked major exchanges and brokers to block access from the service and cut off all active sessions. On 22 October, OANDA Japan told customers that MT4 and MT5 logins used on the service may have been exposed, and briefly held withdrawals for a security check.

Under the new law, police and Japan’s Self-Defense Forces can break into attackers’ servers and disable them before damage spreads, Jiji Press reported . However, GMO is not among the critical infrastructure operators the law designates, according to Impress Watch .

Meanwhile, GMO will pay ¥5,000 ( $32) to every current customer of the service, whether or not they lost money. It will also cover realised losses from unauthorised trades, minus any refunds from brokers.

The service will not return. Customers can move to a separate cloud service free for six months, and GMO will publish details of the loss claims process by 6 November. The company said it cannot yet estimate the cost to its earnings.

Get the TNW

Get the most important tech news in your inbox each week.