GMO Internet checks customer data posted by suspected hackers after Onamae cloud breach
GMO Internet is verifying information a suspected attacker posted online after unauthorised access to its Onamae Desktop Cloud service. The company later said the hacker's website had been taken down.
1 / 2
The story, neutrally told
Centre · 1Japan's GMO Internet said on 27 October that a suspected attacker had published information apparently linked to its customers and business, following unauthorised access to its Onamae cloud desktop service, which provides virtualised desktops to financial traders. TechCrunchN “it believes the attacker has published information allegedly linked to customers and its business”“which provides virtualized desktops to financial traders” Read at TechCrunch ↗ Centre · 1The company said the contents were still being verified and the full extent of the incident remained unclear. TechCrunchN “the contents are still being verified and the full extent of the incident remains unclear” Read at TechCrunch ↗ Centre · 1According to TechCrunch, GMO shut down the Onamae Desktop Cloud service on 21 October and received an email from hackers demanding about 8 billion yen (about $50 million). It reported the incident to police on 22 October. TechCrunchN “Oct 21: GMO Internet shut down its Onamae Desktop Cloud service”“demanding about 8 billion yen (~$50 million)”“Oct 22: The Japanese company reported the incident to Japanese police” Read at TechCrunch ↗
Centre · 1Anadolu Agency said an investigation prompted by a customer inquiry confirmed on 20 October that a third party had installed an unauthorised program on the servers of some customers. Anadolu AgencyN “confirmed Oct. 20 that a third party had installed an unauthorized program on servers of some customers” Read at Anadolu Agency ↗ Centre · 1GMO advised customers to reset passwords after receiving reports of "unauthorized operations" on customer trading accounts, and said 27,000 servers may be affected. On 24 October it said it would offer compensation and alternative service, and from 25 to 26 October it began collecting customers' devices to check for malware. TechCrunchN “The company said 27,000 servers may be affected by the breach.”“Oct 24: GMO Internet said it would offer customers compensation and alternative service”“Oct 25-26: The company began collecting devices from customers” Read at TechCrunch ↗ Centre · 1Anadolu, citing Kyodo News, reported that the hacker disclosed a customer's information on 27 October after the company did not respond to the ransom demand. On 28 October GMO said the site's domain had been taken down and that it would act if another site appeared. Anadolu AgencyN “disclosed the customer’s information Tuesday after the company failed to respond to a ransom demand”“We have confirmed that the offender's website domain has been taken down” Read at Anadolu Agency ↗
Centre · 1Per Kyodo's investigative source, the customer whose data was posted is under Metropolitan Police Department protection for safety reasons and told investigators the posted details were "partially correct and partially wrong". Police asked GMO to assess the extent of the damage. Anadolu AgencyN “is under Metropolitan Police Department protection due to safety concerns”“partially correct and partially wrong”“Police asked GMO to assess the extent of the damage.” Read at Anadolu Agency ↗ Centre · 1TechCrunch noted that about a week earlier GMO's cybersecurity unit reported evidence that a Chinese AI-enabled penetration-testing tool called Artex had been used in hacks on Japanese companies, but GMO has not publicly linked Artex to the Onamae breach. A GMO spokesperson did not respond to TechCrunch's request for comment. TechCrunchN “the company said it has not publicly established a connection between Artex and the breach of Onamae”“A spokesperson for GMO Internet did not respond to TechCrunch’s request for comment.” Read at TechCrunch ↗ Centre · 2Japan's Financial Services Agency told TechCrunch it issued guidance in May urging financial institutions to prepare for rising cybersecurity vulnerabilities. Anadolu placed the incident among a run of Japanese corporate breaches, noting that Japan Airlines reported on 28 October that data on 92,000 customer records may have leaked. TechCrunchN “it issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities” Read at TechCrunch ↗ Anadolu AgencyN “personal information from 92,000 customer records may have been leaked” Read at Anadolu Agency ↗
Every sentence links to the reporting it rests on. The pill in front of each says where its sources sit: Left, Centre or Right when one side supplies at least half of them, Mixed when they are evenly split. The number is how many outlets it cites.
Left0 outlets
No left outlet in our sources has covered this story yet.
Centre2 outlets
- Framing
- Both outlets treat it as a developing corporate cyber incident. TechCrunch gives a timeline and ties it to AI-enabled hacking tools and regulator guidance; Anadolu, relaying Kyodo News, focuses on the site takedown, the ransom and police involvement.
- Emphasis
- TechCrunch: scale (27,000 servers), ransom size, timeline, Artex context. Anadolu: takedown, the protected customer, the Japan Airlines leak.
- Leaves out or plays down
- Anadolu omits the 8 billion yen figure, the server count and the Artex context. TechCrunch, published earlier, does not cover the takedown or the customer's remarks.
- Charged language
- “unauthorized operations”
- For example
-
“The IT and internet services giant said on its blog” — TechCrunch
“The airline is among the latest Japanese companies to report an unauthorized access incident.” — Anadolu Agency
Right0 outlets
No right outlet in our sources has covered this story yet.
What every side reports
- Unauthorised access hit GMO Internet's Onamae Desktop Cloud service.
- A suspected hacker posted information said to relate to a customer or customers.
- GMO is working with Japanese authorities.
Where accounts differ
-
Date the intrusion was identified
- Centre
- TechCrunch dates the service shutdown and discovery to 21 October; Anadolu says an investigation confirmed the unauthorised program on 20 October. The two may describe different steps.
GMO Internet organisation
Says it is verifying the posted data, has advised password resets, will offer compensation and alternative service, reported the matter to police, and had the hacker's domain taken down.
“GMO Internet has since advised customers to reset their passwords” — TechCrunch
“The provider said it would take action if it found another website.” — Anadolu Agency
Left0 articles
No coverage yet.
Centre2 articles
-
Japan internet giant GMO says hackers posted stolen customer data
Neutral Factual breach report with a dated timeline and wider context on AI hacking tools and Japanese regulation.
-
Japanese internet provider confirms takedown of hacker website claiming to contain customer data
Neutral Short follow-up relaying Kyodo News on the takedown, the ransom and the customer under police protection.
Right0 articles
No coverage yet.
- 27 Oct 13:32 First TechCrunchN Japan internet giant GMO says hackers posted stolen customer data
- 28 Oct 13:52 +24h 20m Anadolu AgencyN Japanese internet provider confirms takedown of hacker website claiming to contain customer data
Times are when each article was published, or when we first saw it if the outlet gave no time.
Ask about this story
Loading…