A week after GMO Internet’s Onamae.com Desktop Cloud service was breached, the person behind the attack followed through on the extortion threat in part. GMO says it confirmed at 12:30 JST on 27 October that the attacker had published information the attacker described as belonging to GMO and its customers. The company is still verifying the contents and warns that some of it may be false. As of 13:55 that day it had not seen the threatened ransomware attack run on customer machines, and BleepingComputer reports it appears the attacker never triggered it.
The company says the attacker demanded about ¥8 billion (roughly $50 million) and that it will not pay, because payment would not guarantee deletion or stop misuse of the stolen data. Earlier in the week it had warned that the attacker planned to leak data and detonate a payload planted on customer servers, and on 27 October asked customers to back up their data, disconnect their PCs from the network and power them down before the noon deadline. GMO is working with Trend Micro on recovery, says it has contacted police and is preparing legal action against people who spread the leaked data. This follows our earlier report on the intrusion, where up to 26,739 servers were first reported at risk.
How to check if you’re affected
Affected products are Onamae.com Desktop Cloud servers. If you are a customer, the company’s notices say:
- Do not visit or share the site hosting the leaked data. GMO says it has confirmed that people who accessed that site had their information taken by the attacker, and that anyone who already visited should run a full scan with their antivirus software.
- If your information is in the leak, GMO says it will contact you individually. It has also begun considering compensation beyond the flat ¥5,000 it announced earlier.
- Watch for phishing by email, SMS or phone that mentions the incident. GMO says it never asks for your password or authentication codes, and you should not pay anyone offering to “recover” lost funds.
- BleepingComputer reports GMO has said MetaTrader 4 and 5 credentials and trading-account details may have been exposed, and urged customers to reset passwords and end active sessions. If you ran MetaTrader on Desktop Cloud, check your broker account for activity you do not recognise.
The notices are in Japanese; the details above come from GMO’s updates numbered 10 and 11 and from BleepingComputer.