GMO's Onamae.com Desktop Cloud breached; attacker demands $50 million
Original title: Japanese virtual desktop cloud hacked so hard it asks to be banned
GMO says up to 26,739 VDI servers may be affected, trading passwords were exposed, and it will not pay.
Japanese ISP GMO Internet said an attacker installed malicious programs on some customers' Onamae.com Desktop Cloud servers, which it markets for foreign-exchange trading. The company later said systems had security vulnerabilities, the environment was accessed without authorization, and customer information was taken outside the company. Some customers reported unrecognized trades, and GMO said third parties had probably seen trading-service passwords. A person believed to be the attacker demanded $50 million and threatened to publish company and customer information; GMO said it will not pay.
Unconfirmed: The attacker is only described as a person believed to be responsible, and GMO's claim that misuse of ARTEX sourced attacks on about 20 Japanese companies is uncorroborated here.
- GMO warned that 26,739 VDI servers may have been hit.
- It asked major trading services to end sessions and block requests from the cloud.
- Users were told to change trading passwords from a device they do not use for trading.
- CEO Masatoshi Kumagai said in-house white-hat findings were fixed too slowly.
- GMO offered ¥5,000 and said it would cover trading losses caused by the attack.
Impact: Customer data, trading passwords, and unauthorized account trades
| Product | Affected |
|---|---|
| GMO Internet Onamae.com Desktop Cloud | — |
- 1.Change trading-account passwords from a device not used for trading.
- 2.Disconnect active trading sessions or ask the broker to disconnect them.
- 3.Watch trading accounts for unrecognized transactions.
- Vendors
- GMO Internet
- Products
- Onamae.com Desktop CloudARTEX
- Countries
- Japan
From the original article
4 min read at theregister.comCEO admits service used for foreign exchange trading had holes company was slow to fix
By Simon Sharwood · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.