On October 24th, GMO Internet Group announced that it would pay 5,000 yen as "consolation money" to all users of the service, as well as compensate for losses incurred due to fraudulent transactions, in response to a cyber attack on Onanae.com Desktop Cloud, a VPS for automated FX trading, in which users' trading accounts were fraudulently manipulated. It also revealed that there was a "security issue" in the system and customer information had been taken out.
The company has positioned this cyberattack as "the first case to activate active cyber defense," and has strongly requested government agencies to take the lead in taking effective measures to track, block, and neutralize the attack base.
Pay the actual loss amount If the exchange refunds you, only the difference amount will be paid
The condolence money of 5,000 yen will be paid to all users of the service, regardless of whether they have suffered financial damage or not. You will be notified via email by October 30th regarding the pick-up procedure and payment period.
Users whose fraudulent transactions were made due to unauthorized access will be compensated for realized losses (transaction losses, fees, etc.) incurred in their accounts. The company will confirm whether it is eligible for compensation based on materials such as transaction records and access.
For compensation, customers are requested to provide information that allows them to objectively confirm the date, time, content, and amount of loss of the transaction in question. They are also requesting exchanges to explain the situation and consult with them about cancellations and refunds of transactions.
If a refund is received from an exchange, etc., the company will deduct that amount and pay the remaining amount. If a refund is not granted, the actual loss amount will be paid based on the company's investigation.
Information on how to apply, required documents, application period, and payment period will be sent to the registered email address by November 6th.
GMO: “We will not respond to requests from attackers”
The company also revealed that it had received demands for money from people believed to be attackers, but asserted that it "will not respond to requests from attackers."
If the company does not comply with the request, the attacker will
Continuing fraudulent operations on customer trading accounts opened at over 70 domestic and foreign securities/FX companies (damage to account balances due to fraudulent orders)
Unauthorized disclosure of information regarding Onanae.com Desktop Cloud and the PCs of customers connected to the service, and execution of ransomware attacks.
Unauthorized disclosure of information regarding GMO Group's systems and operational structure, etc.
--- He said he has been contacted.
However, the company explained that it would not respond to the request because ``even if we comply with the request, it does not guarantee that the information obtained will be deleted or that unauthorized use will be prevented.'' We are coordinating with the police and other relevant organizations to take action.
Overview of the service and details of the damage...there is a "security issue"
``Onanae.com Desktop Cloud'' is a VPS (virtual private server) for investors who conduct FX (foreign exchange margin trading). By using this service, you can virtually use "another Windows PC" and run automatic trading software 24 hours a day.
Users save login information (ID, password) for each securities company and FX company in the automated trading software installed within the service (such as ``MetaTrader 4'' and ``MetaTrader 5''), then log in to each company's FX service and trade automatically.
GMO began an investigation on the 19th after receiving inquiries from users, and on the 20th confirmed that a third party had installed a malicious program on some users' server environments. On the 21st, servers for all plans were stopped one by one. We stopped the network connection of the affected systems and cut off the route for unauthorized access. The number of servers potentially affected is 26,739.
A subsequent investigation confirmed that there was a security issue in the system, and that customer information had been taken out through unauthorized access. It is possible that the login information for trading accounts stored on the server was obtained by a third party and used fraudulently.
GMO suspended the service two days after the investigation, but if login information was stolen before the suspension, it is possible that it could be used for malicious purposes even after the suspension. Furthermore, even if you change your password, if the existing login session is maintained, there is a risk that a third party may be able to continue transactions.
For this reason, GMO is asking users to change their account passwords and log off (disconnecting sessions), and is also requesting major exchanges and securities companies to forcibly disconnect active sessions.
Update the security configuration without restarting the current system infrastructure
GMO has announced that it will not restart the current system infrastructure that was compromised and will revamp its security configuration. Users who wish to do so will be guided to migrate to an alternative service operated on a different cloud platform, and will be provided free of charge for six months after migration.
