Masatoshi Kumagai, CEO of GMO Internet Group, apologized to users and stakeholders on his blog on October 25, following an unauthorized access incident involving "Onamae.com Desktop Cloud." He explained that while internal white hat hackers had previously identified security vulnerabilities in the service, the organization ultimately failed to implement adequate defenses.
Onamae.com Desktop Cloud is a service that enables remote operation of Windows environments in the cloud, often utilized for automated trading tools such as FX. GMO Internet, the operator, announced in its fourth report on October 24 that it had identified security issues within the system, confirming both unauthorized access and the exfiltration of user information. The company has also received reports from some users regarding unfamiliar transactions appearing in their trading accounts.
White hat hackers are specialists who identify system weaknesses to bolster defenses. According to Kumagai, the on-site team had acknowledged the prior warnings and was in the process of implementing countermeasures. However, he stated that their cautious approach, which considered the impact on service availability and the prioritization of other tasks, resulted in an insufficient depth and speed of response, ultimately allowing attackers to exploit the vulnerability.
Furthermore, GMO Internet plans to pay a uniform 5,000 yen consolation payment to all active users and will separately compensate for actual losses from fraudulent transactions confirmed to be a result of the unauthorized access. The company will also provide an alternative service on a new, independent infrastructure, distinct from the compromised system, and offer it free of charge for six months following migration.
Made with AI
