Japanese internet company GMO Internet is investigating a data breach incident, following which its Onamae cloud desktop service was suspected of having been accessed without authorization. This service provides virtualized desktops for financial traders.

This IT and internet service giant stated in a blog post that they believe the attackers have released information allegedly related to customers and their businesses. However, this information is still being verified, and the full extent of the impact of the incident is not yet clear.

GMO Internet It is recommended that customers reset their passwords thereafter, as the company has received reports of "unauthorized operations" on customers' trading accounts. The company indicates that approximately 27,000 servers may have been affected by this intrusion.

GMO Internet The spokesperson did not respond to the comment request from TechCrunch.

This incident occurred about a week ago, when the network security department of this Japanese company reported separately that they found evidence indicating that a Chinese penetration testing tool named Artex had been used in hacker attacks against companies across Japan. However, the company stated that they have not yet publicly confirmed a link between this intrusion incident and another involving Artex and Onamae.

According to a report from CrowdStrike earlier this month, the Artex tool was also used to attack Korean financial institutions in September. These attacks mainly relied on exploiting weak security controls, such as the lack of multi-factor authentication. Reuters reported that the Chinese developers of Artex subsequently stopped making public updates and turned the tool into a closed-source one after it was linked to cyberattacks against banks.

A spokesperson from the Japanese Financial Services Agency ( FSA ) told TechCrunch that the agency issued guidance in May urging financial institutions to be better prepared for cyber security vulnerabilities.

Regulatory authorities call for enhanced basic defenses, including "vulnerability management, layered defense, and incident preparedness," while also encouraging enterprises to use AI and other security tools, the spokesperson added.

The following is the timeline for the Onamae event:

• On October 21st: After discovering that its system had been accessed without authorization, GMO Internet shut down the Onamae Desktop Cloud service. The company also received an email from hackers demanding a payment of approximately 8 billion yen (about 50 million US dollars).
• October 22: This Japanese company reported the incident to the Japanese police and released another public update.
• October 24: GMO Internet indicates that compensation and alternative services will be provided to customers, while seeking assistance from government agencies as well.
• From October 25th to 26th: The company began collecting devices from customers in order to detect malware and gain a better understanding of the extent of the losses.
• October 27: This Japanese IT company stated that the suspected attackers have released information that appears to be related to the company and its customers. GMO indicated that they are still verifying whether this information is true.