Kai Hirota

9 min read1,830 words

#gmo-breach#security#japan

GMO breach, part 1: A Japanese cloud provider was warned 2 years before it was hacked

GMO Internet, a major Japanese internet group, was told by its own security company in April 2024 that one of its services had security weaknesses. In 2026, attackers got into that service, could reach up to 26,739 customer machines, and had 76 days inside before anyone at GMO noticed.

日本語版

GMO Internet is a Japanese internet group that runs domain registration, hosting, payments and an online brokerage. On April 24, 2024, its own security subsidiary reported weaknesses in one of its services, Desktop Cloud.[1] On October 20, 2026, customers reported problems, and GMO discovered that attackers had been inside that service for 76 days.[1]

A timeline from April 2024 to October 2026. On April 24, 2024, Ierae reports the weaknesses, followed by emergency maintenance with no check that the fixes worked. More than 2 years pass with no such check and no report to the board. On August 5, 2026, the attackers get in; they spend 76 days inside, 64 of them with administrator access to the server that controls every customer's machine, until GMO finds out on October 20.

Desktop Cloud rented out Windows computers that customers used over the internet. Most customers used them to run automated currency-trading programs, which need to keep running while the customer's own computer is off.[3] Those machines held the login details for the trading accounts.[2] By GMO's count, up to 26,739 of them were within the attackers' reach.[1] GMO says those login details may have been taken and misused, and it is reimbursing trades that customers did not place.[2] The attackers demanded US$50 million,[3] later US$1 million,[14] and GMO refused. On October 27 they published one customer's personal data.[15]

Timeline, and what could have prevented it#

The first 2 columns are the timeline GMO gave at its first press conference, on November 2.[1] The third column shows what wasn't done that could have prevented the breach.

WhenWhat happenedWhat was missing
April 24, 2024, GMO's own security company, delivers its findings on Desktop Cloud to the executives in charge of Desktop Cloud's business, service and systems.[1]Nothing yet.
April 26 to May 20, 20244 rounds of emergency maintenance. Nobody asks Ierae to check whether the fixes worked. GMO's verdict, 2.5 years later: the response was lacking "in both depth and speed".[4]A re-test by Ierae to confirm the fixes worked, and a rule that a finding like this goes to the board.[4]
August 5, 2026The attackers get into one customer's rented machine.Monitoring that notices when a customer's rented machine has been taken over.
August 17They obtain an administrator account, a login with full control over the system, and use it to reach GMO's management server. That one computer controls every customer's rented machine.An alarm whenever someone signs in to the management server as an administrator.
September 20 to October 14Malicious software is installed on customer machines from that management server.Monitoring of what the management server was sending to customer machines.
October 20Customers complain. GMO investigates and finds the malware.
October 21GMO shuts every server down and discloses the incident.[5]

For 64 of those 76 days the attackers held an administrator account on the management server, and nothing at GMO raised an alarm.

Diagram of the attack. 1: on August 5 the attackers get into one customer's rented Windows machine. 2: on August 17 they obtain an administrator account on GMO's management server, which controls every rented machine. 3: from September 20 to October 14 the server sends malware out to rented machines, up to 26,739 of which were in reach. Each rented machine is connected to the customer's own PC by drive sharing, a setting that let the rented machine read files on the customer's PC and was on by default.

Why the report never reached the chief executive#

The 2024 report did not reach Masatoshi Kumagai, the group's founder and chief executive, who said at the press conference that he learned of it only after the breach.[1] Kumagai said, "I should have stepped in on the finding 2 years ago."[6] At another point he said, "We failed to put the finding to use in running the service."[7]

The explanation came from the group's legal head, not from Kumagai: there was no clear standard for which weaknesses had to be taken to the board, where Kumagai would have seen them.[4] Ierae, the security subsidiary, is a separate company inside the group, with no authority over the service it audited.[1]

A setting that reached customers' own computers#

Customers operate their rented machine through a window on their own computer, a remote-desktop connection. A setting in that connection, drive sharing, was switched on by default for convenience.[1] It lets the rented machine read the files on the customer's own computer, which a trading program has no use for. GMO says the attackers abused it, which is how they could threaten customers' own PCs as well as the rented machines,[7] and why GMO told people to back up their PCs and switch them off before noon on October 27, when the attackers had said they would publish customer data and launch a attack.[3]

What GMO talked about instead#

The second half of the 3.5-hour press conference was a prepared presentation on the threat from AI-driven attacks.[8] GMO has said far more about 3 other topics than about the 2024 report: North Korea, AI, and what customers should do to protect themselves.

North Korea. Kyodo News looked at who visited the attackers' website in its first hours. 5 of the visiting internet addresses had earlier been linked to North Korean hacking groups.[9] GMO's own belief that North Korea was behind the attack rests mainly on features of the malware.[9] The attackers' website also carried traces linked to other countries, including the United States and Japan, which experts say may have been planted to mislead investigators.[19] The company has reported its view to the government, which has not confirmed it.[9]

AI. Kumagai argued at length that AI tools are flooding the internet with automated attacks. Asked directly whether AI was used in this one, he answered, "There is no evidence that AI was used." He asked that the two halves of the conference be judged separately.[6] There is some basis for the general concern: on October 19, GMO's security subsidiary reported finding . It was on the servers used in a separate wave of attacks on about 20 Japanese companies, and Kumagai himself said that case was unrelated to this one.[10]

Users should protect themselves. GMO advised customers to change passwords, log out of the service and secure their PCs.[5] The advice was sound, but the malware was coming from GMO's management server, which no customer could reach.

Compensation and consequences#

What GMO has committed to:

  • ¥5,000 (about US$33) to every current customer, whether or not they suffered any loss.[11]
  • For anyone whose data the attackers publish, a payment that depends on what was published. The amounts add up if more than one applies. GMO caps the total it will pay for any one publication at ¥3 million (about US$20,000):[12]
    • ¥10,000 (about US$67) for basic details such as name and contact information.
    • ¥15,000 (about US$100) for financial or login details such as account IDs and passwords.
    • ¥25,000 (about US$167) for sensitive personal information.
  • Full reimbursement of losses from unauthorised trades, with the procedure to begin on November 6.[1]
  • 6 months of a replacement service at no charge. The old platform will not be restarted.[1]

What GMO's executives face:

  • Kumagai takes a 30% cut in monthly pay for 3 months from December, and 3 other executives take cuts of 20% to 25% over the same period. Further measures depend on an internal review.[13]
  • Nobody has resigned or been removed.[13]

What remains undisclosed: how the attackers got into that first customer machine, the vulnerability itself, the content of the 2024 report, and the measures that will prevent a repeat.[1]

How Binance disclosed a larger breach#

What happened at Binance#

In June, a Binance wallet engineer installed a tampered copy of a developer tool. The security team caught it, replaced his laptop and changed his passwords and keys, but by then the attackers had learned his role and who his colleagues on the wallet team were. In September, another engineer was approached on a job site, interviewed by people posing as an HR representative and the chief executive of a company that did not exist, and told to download a take-home assignment onto his work computer. It contained malware. On October 20, working from that computer and using an AI assistant that Binance's staff relied on, the attackers took over the computers of 2 engineers who ran the wallets. On one of them they found a token, a digital pass that let whoever held it install software on Binance's systems.[17]

On October 29, 9 days after GMO found its malware, the attackers used the token to take about US$6.36 billion out of Binance's hot wallets: the accounts an exchange keeps online so that customers can withdraw at any time. Most of the money was transferred out within about 20 minutes of the first transfer.[16] Binance's own monitoring raised an internal alert while the transfers were still going out.[17] Within 2.5 hours of the first transfer, Binance's founder had posted on X that the transfers appeared to be a hack, and the exchange had paused withdrawals.[18]

How Binance's disclosure differs from GMO's#

On November 3, 5 days after the theft, Binance published its initial report. It opens with "This should not have happened", sets out the attack from the start, lists the systems rebuilt and the passwords and keys cancelled, and commits to an independent review. It also admits a failure of its own: Binance caught the June infection but did not work out what the attackers had already learned from it. Some technical details are withheld so that other attackers cannot use them.[17]

GMO gave the same reason for withholding details at its press conference, 13 days after it found the malware, but it has not said how the attackers got into the first customer machine at all.[8] Binance did not notice the attackers on its engineers' computers either, but its monitoring caught the theft while it was under way. GMO's attackers held an administrator account on the management server for 64 days without setting off a single alert.

References#

  1. @IT, 「ネットのセキュリティもGMO」の実態 イエラエの事前指摘はなぜ放置されたか：GMO記者会見を読む, November 3, 2026.
  2. ScanNetSecurity, 「お名前.com デスクトップクラウド」に不正アクセス、取引口座のログイン情報等が取得され不正利用された可能性, October 26, 2026.
  3. Innovatopia, 【解説】お名前.com デスクトップクラウド、攻撃者が情報公開 GMOは要求を拒み懸賞金100万ドル, October 28, 2026.
  4. ITmedia Business Online via Yahoo! News, 「31年間『もうける』と言ったことはない」GMO熊谷代表、不正アクセスで謝罪も露呈した“組織の壁”, November 2, 2026.
  5. GMO Internet Group, 【重要】「お名前.com デスクトップクラウド」への不正アクセスに関する現在の対応について（第9報）, October 27, 2026.
  6. Nikkei, GMO熊谷正寿社長「2年前の指摘、私が介在すべきだった」 会見の一問一答, November 2, 2026.
  7. Innovatopia, サイバーイージス構想と全額補償｜GMO会見で出た答えと残った問い, November 2, 2026.
  8. Kenta Yamaguchi, Yahoo! News expert column, GMO不正アクセス 「3時間半」の記者会見でも解決しなかった疑問とは, November 3, 2026.
  9. South China Morning Post, North Korean hackers behind Japan's massive GMO data leak, investigation finds, November 2, 2026.
  10. ScanNetSecurity, GMOサイバーセキュリティ byイエラエ、不正アクセス攻撃元にAI自律型ペンテストシステム「ARTEX」を確認, October 21, 2026.
  11. ScanNetSecurity, 「お名前.com デスクトップクラウド」に不正アクセス、見舞金として一律 5,000円を支払い, October 27, 2026.
  12. Impress Watch, GMO、情報を公開された利用者に区分別の特別お見舞金（第12報）, October 27, 2026.
  13. セキュリティ対策Lab (Rocket Boys), GMO、サイバー攻撃で熊谷正寿氏ら役員4人が報酬減額, November 2, 2026.
  14. 共同通信 via OANDA, GMO、身代金1・5億円を拒否, October 27, 2026.
  15. ITmedia NEWS, GMO、ランサム被害にあった顧客に新しいPC提供へ 犯行グループは1人の顧客情報公開か, October 27, 2026.
  16. TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, October 29, 2026.
  17. Binance, 29 October Binance Security Incident: Initial Findings and Response Update, November 3, 2026.
  18. TechCrunch, Binance pauses withdrawals as hackers suspected of stealing billions in crypto, October 29, 2026.
  19. 共同通信 via OANDA, 【独自】GMO攻撃、北朝鮮ハッカーか, November 1, 2026.