More than 26,000 cases affected securities firms and other businesses
GMO Internet Group, Inc. apologized at a Tokyo news conference on Monday after cyberattacks resulted in unauthorized access to its Onamae.com Desktop Cloud service. The company said more than 26,000 cases affected dozens of securities firms and other businesses, with information leaks and transactions customers did not recall making.
The conference was GMO’s first since the security problems surfaced. Chief Executive Masatoshi Kumagai and other GMO executives bowed deeply and repeatedly, as is the custom here, at the news conference in Tokyo. Kumagai said, “I offer my deepest felt apologies,” stressing that the company took the problem seriously.
Kumagai, who founded GMO in 1991, acknowledged that the company had been warned internally about a systemic weakness to such attacks but failed to take proper action. He also apologized for recent social media posts, including a photograph of himself smiling, which he said may have hurt victims’ feelings.
Kumagai is taking a 30% pay cut for three months, while other senior executives are taking smaller pay cuts. GMO said it would compensate customers for their losses and promised all customers a payment of 5,000 yen ($30) to express “goodwill.” The company also said it would switch to a new security system and work to prevent a recurrence.
Recent Japanese media reports carried interviews with several people who said huge amounts of money had gone missing from a GMO service, although they had not initiated the transactions. The interviews were separate from the company’s announcement of more than 26,000 cases.
GMO acknowledged that the attackers had deployed ransomware and said it had refused to pay. The company is offering $1 million for information that leads to the identification and arrest of the attackers.
GMO established a “GMO Cybercrime Bounty” site that accepts information in English, Japanese or Chinese. The company said it had received more than 400 submissions as of the previous week.
The problems at GMO have brought Japan’s broader cybersecurity vulnerabilities to light. Some experts warned that those vulnerabilities had been brushed off for years and lacked a sense of crisis. The Japanese government declined to comment on the GMO case, including possible suspects. Prime Minister Sanae Takaichi has promised to strengthen Japan’s cybersecurity measures.
The disclosures came amid growing concern about cybersecurity. Binance, described as the world’s largest cryptocurrency exchange, said Friday that hackers had stolen more than $6 billion in what appeared to be the largest cryptocurrency heist on record. Blockchain firms pointed to the attack as coming from a North Korean hacking unit.
Tokyo-based GMO provides internet services related to cybersecurity, online marketing and infrastructure systems, and it supports robotics and artificial intelligence. Kumagai spoke tearfully and passionately at the news conference about the work he and his employees had done to deliver the internet and other technology to customers.
The financial effect of the cyberattacks on GMO remained unclear. The company’s shares fell after news of the breaches surfaced, though the stock had fluctuated over the previous year. The news conference began after Tokyo trading closed, and GMO’s shares had fallen 17.5% so far that year.