GMO's foreign exchange trading service was hacked, and its security company issued an early warning in 2024

(Central News Agency Tokyo 1st Comprehensive Foreign News Report) The services of GMO Network Group, a large Japanese IT company, have previously been subject to improper access. According to GMO officials, its information security company pointed out loopholes in the system as early as April 2024 and requested a fundamental review of the system. However, GMO did not take adequate countermeasures, which ultimately led to this incident.

"Nihon Keizai Shimbun" reported that the vulnerability was pointed out by GMO Cybersecurity by Ierae, a subsidiary of GMO. The company joined the GMO Group in February 2022 and is famous for having a group of top "white hat hackers".

When Ierae conducted a comprehensive inspection of the Internet business services operated by GMO in April 2024, it discovered that there were loopholes in the system. At that time, Ierae's senior management directly reported the discovery of the vulnerability to GMO officials and explained the need to take countermeasures.

The services covered by the report include the "namae.com Desktop Cloud" that was improperly accessed this time, which is used for automated trading of foreign exchange margin trading.

In this incident, a third party had operated users' foreign exchange trading accounts, and customer information on 26,739 servers may have been browsed. The attacker demanded a ransom of US$1 million (approximately NT$31 million) from GMO, but GMO stated that it would not pay.

The report pointed out that Ierae had foreseen the disaster in 2024. The report pointed out that if attackers exploit the vulnerability, they may steal authentication information required for foreign exchange transactions, and also mentioned that they may be subject to ransomware attacks.

The report believes that this means that GMO, which received the report at the time, has realized that user data on the server may be used as a "hostage" and become a bargaining chip for attackers to blackmail.

GMO officials said that the entire system must be updated to fix the loopholes, but the company has not taken adequate countermeasures. "Maybe it's because we can't make up our mind to completely stop services that are sold 24 hours a day," the official said.

Masaru Ito, president of GMO Networks, said at an employee briefing on the 29th of last month: "As of now, I regret it very much." Masahisa Kumagai, chairman and president of the parent company GMO Networks Group, also explained on his personal blog on the 25th of last month: "The depth and speed of the response were not sufficient, allowing attackers to take advantage."

In an interview with Nikkei, GMO's public relations department confirmed that it had indeed held an employee briefing meeting, but regarding the subsidiary's reporting of system vulnerabilities, it stated: "We will not respond to the time, content and relevant personnel of individual pointed out matters."