GMO Internet Confirms Domain Suspension of Attacker Site; Announces Special Consolation Payments and Up to $1M Bounty Program

The series of incidents involved malicious code being installed on お名前.com デスクトップクラウド servers, resulting in the publication on an attacker site of information for 26,739 potentially affected servers. GMO reported in its Report No.14 that it confirmed the domain suspension of the site around 4:00 a.m. on October 28. However, the company noted that domain suspension does not eliminate the possibility of recurrence and that it will continue to monitor the information.

In Report No.13 released the same day, victim support measures were detailed. Customers whose information was published in the attack will receive special consolation payments ranging from ¥10,000 to ¥25,000 depending on category. Customers who suffered ransomware damage will be provided with a new PC of equivalent performance. In addition, a bounty program has been established, with total rewards capped at USD 1,000,000, for information leading to the identification and prosecution of the attackers.

According to the chronology so far, authentication information such as login credentials for trading accounts stored on the servers was exfiltrated, and unauthorized trades in users' securities and FX accounts have been confirmed. The intrusion route, the specifics of the data obtained, and the number and amounts of unauthorized transactions are under investigation, and further reports are expected to follow.

Because authentication data was taken from customer environments on the cloud and directly led to financial transactions, this case represents one of the fastest forms of "monetization of leaked information." Effective countermeasures include operating policies that do not store securities account login credentials in desktop cloud or remote environments, and thorough enforcement of multi-factor authentication.