GMO breach, part 2: Why engineers' warnings don't reach management in Japan

In 2026, attackers spent 76 days inside Desktop Cloud, a rented-computer service run by GMO Internet, a Japanese internet group, before anyone there noticed. 2 years earlier GMO's own security subsidiary, Ierae, had warned about weaknesses in the service. The warning was correct, it was read by 3 of GMO's executives, and nothing changed.^[1] Inside most Japanese companies that outcome is what you would expect, given who holds authority over technology here and what the country pays the people who understand it.

2 failures at once#

Two things went wrong at GMO.

The first is that the engineers who find the problem have no authority. GMO's security subsidiary found the problem, and the 3 executives it reported to saw it. None of them could order a second check of whether the weaknesses had been fixed, and none was made.^[1]

The second is that the people with authority cannot judge a technical risk. The group's legal head said at the press conference that there was no clear standard for which weaknesses had to be taken to the board (in Japan, mostly the company's own senior executives).^[2] A board with someone on it who can read a security tester's report will ask to see it. Without that person, the report is one agenda item among many.

A company can cope with one of these, but not both. Where engineers hold authority, they can tell a serious finding from a routine one without any escalation rule. Where leaders are not technical, a strict escalation rule still gets findings to them, but slowly, and only if someone stays long enough to carry each one upward and explain it. In Japan that person is often an outside contractor, who leaves when the project ends. Ierae was part of the group, not a contractor, but it had no say over the service it tested. GMO had neither an escalation rule nor an engineer in charge.

Most Japanese companies lack both, because of who runs them and what they pay engineers.

Who runs the companies#

The table below lists the founders and chief executives of the largest technology companies in the United States and the largest internet companies in Japan, and whether they worked as an engineer or scientist before running a company. A degree alone does not count; the question is what they did for a living.

Japan's engineer-founders run Preferred Networks and SmartNews, the 2 smallest companies on the list. In the United States, the one chief executive who was never an engineer, Tim Cook, took over Apple when it was already mature.

Government is no different. In September 2019, Naokazu Takemoto became Minister of State for IT policy. At the time he chaired a group of members of the Diet, Japan's parliament, devoted to protecting hanko, the carved personal seals that stand in for a signature on Japanese contracts and official forms. Asked at his first press conference about seals and digital government, he said the two would have to find a way to prosper together, and that fully digitising seals was a matter of life and death for the people who make them.^[3]

Software engineer salaries by country#

The table below compares what a software engineer earns with the median full-time worker in the same country, using each country's own statistics, with accountants, management consultants and physicians for reference. The figures are median base pay before tax, without bonuses or overtime, converted to US dollars; the number in brackets is that pay divided by the median full-time worker's pay in the same country.^[4]

Japan's physicians earn 2.8 times the median worker, more than in Britain, Germany or Australia, and its consultants and accountants earn about as much relative to the median as they do elsewhere. Software engineers are the exception. At 1.15 times the median, Japanese engineers are closer to the ordinary worker than in any other country in the table, and they earn less than both accountants and consultants. Germany is the only other country where engineers rank below both, and German engineers still earn 1.46 times the median.

Where the engineers work#

According to the Information-technology Promotion Agency, a government body, 73.6% of Japan's IT workers in 2020 worked for contractors, and only 26.4% in-house at the companies that use the systems. In the United States the proportions are reversed: in 2021, 35.1% worked for contractors and 64.9% in-house. Japan's share in 2015 was 72.0%, so 5 years changed almost nothing.^[5]

Contractors also pass the work down to subcontractors of their own. The Japan Fair Trade Commission's 2022 survey of the software industry describes it as a supply chain of multi-tier subcontracting, and documents the abuses that structure invites: price squeezing, and changes to what was ordered after the price was agreed, with no extra payment.^[6] By the time the code is written, the person writing it is several companies removed from the person who will use it.

The Japan Fair Trade Commission's own illustration of the structure, from the 2022 survey (figure 2-2-1).^[6]

Part of the reason companies outsource engineering rather than hire engineers is in the law. Article 16 of the Labour Contract Act voids any dismissal that lacks, in the law's words, objectively reasonable grounds and social acceptability, so a permanent employee is very hard to let go.^[7] A company that cannot shrink its engineering team when a project ends has a strong reason never to build one, and to outsource it instead.

Outsourcing also slows the response when a flaw in widely used software is made public. The Information-technology Promotion Agency's 2005 guidance for contractors that build systems for clients notes that their engineers are usually organised by client, so such a company may struggle to know which of the systems it has delivered contain the affected software. It adds that keeping that record up to date for years is hard for systems without a maintenance contract, and recommends starting with the systems under contract.^[11] The client is often in no position to check either. The agency's 2020 survey of IT outsourcing contracts asked both sides why they had not agreed who was responsible for security. Clients most often said they lacked the expertise. Contractors most often said the contract simply keeps renewing, so the terms never come up for review.^[12] For a system whose maintenance contract has lapsed, at a company with no engineers of its own, neither side is responsible for noticing the announcement.

11 apps for one bank#

My bank, MUFG, lists 11 iPhone apps. Each does one thing and has its own login, and they look like the work of different contractors under different contracts. Australia's Commonwealth Bank does everything the 11 do in one app, built in-house.

The same failure at Mizuho and in the COCOA app#

GMO is not the first Japanese organisation in which investigators have found engineers going unheard and leaders unable to judge what they were told. Mizuho Bank had 8 system failures between February and September 2021, and in November that year the Financial Services Agency ordered it to improve its operations. The order named 4 root causes. 3 of them were that the bank made light of system risks and of technical expertise, paid no attention to what was actually happening in its IT department, and had a culture in which staff did not say what needed to be said and did only what they were told. The agency found that the staff needed to keep MINORI, the bank's core system, running had been moved to other work, and that its maintenance budget had been cut. It said the same causes ran through the bank's earlier failures in 2002 and 2011.^[8]

COCOA, the government's COVID-19 app, shows the same pattern inside a contractor chain. In May 2020 the Ministry of Health contracted Persol Process & Technology to build it and approved 5 further companies as subcontractors. On November 25, 2020, someone outside the project reported a bug in the Android version on GitHub, where the app's code was public. On December 4 the report was added to the project's list of items to consider. Nobody acted on it. The bug had been in the app since an update on September 28, 2020, and the ministry did not notice it for 4 months, during which the Android version delivered no contact notifications. It announced the bug on February 3, 2021. The ministry's investigation named unclear roles between the companies as one cause, and found that the ministry, which had nobody who understood apps, had not overseen the project as a whole.^[9]

A later review by the Digital Agency and the ministry put the root cause in the government's own weakness at commissioning and running systems. From July 2021 the Digital Agency handled the next major update itself, the switch to a new version of the Apple and Google system the app relied on, with a team of 4: a lead, an iOS engineer, an Android engineer and a person in charge of quality control and test design. The contractor kept maintaining the rest of the app.^[10]

GMO didn't outsource, but its engineers still had no say#

GMO did not outsource Desktop Cloud, the service that was breached. It was GMO's own service, and the warning came from a company inside the group.^[1] What links outsourcing to GMO's case is how little authority engineers have. Where engineering is outsourced, technical staff rarely hold authority even at companies that build their own products, and executives never learn to weigh a security finding against a product deadline. The 3 executives who received Ierae's report treated it as one input among many, and Ierae had no standing to insist.^[1]

A law could require that security findings reach the board within a fixed period, whether or not the chief executive understands them. Engineers' low pay is a sign of how little weight companies give technical judgement. Until both their pay and their authority rise, findings like Ierae's will keep stopping short of the board.

References#

1. @IT, 「ネットのセキュリティもGMO」の実態 イエラエの事前指摘はなぜ放置されたか：GMO記者会見を読む, November 3, 2026.
2. ITmedia Business Online via Yahoo! News, 「31年間『もうける』と言ったことはない」GMO熊谷代表、不正アクセスで謝罪も露呈した“組織の壁”, November 2, 2026.
3. 東洋経済オンライン, 竹本IT相「はんことデジタル、共栄のため知恵をしぼる」, October 9, 2019; Wikipedia, 竹本直一.
4. Japan: 厚生労働省, 令和6年賃金構造基本統計調査, 職種（小分類）別 第1表 and 第17表 (ソフトウェア作成者 and システムコンサルタント・設計者 combined from the wage-band counts; 公認会計士，税理士; その他の経営・金融・保険専門職業従事者; 医師) and the 概況 for the all-worker median. Australia: Jobs and Skills Australia occupation profiles from the ABS Survey of Employee Earnings and Hours, May 2025, for software and applications programmers, management and organisation analysts, accountants, general practitioners and resident medical officers and other medical practitioners; ABS, Employee Earnings and Hours, May 2025 for the all-full-time median. United States: BLS, Occupational Employment and Wage Statistics, May 2025, national, occupations 00-0000, 15-1252, 13-1111, 13-2011 and 29-1210. United Kingdom: ONS, Annual Survey of Hours and Earnings 2026 provisional, Table 14.3a, basic pay including other pay, full-time, SOC 2020 codes 2134, 2431, 2421, 2211 and 2212. Germany: Statistisches Bundesamt, Verdiensterhebung April 2025, table 62361-0030 by occupation (KldB 2010 expert level: 43414, 71324, 72244, 72304, 81404 and 81434) and table 62361-0031 for the all-worker median, median gross monthly earnings without special payments, full-time. Converted to US dollars at the European Central Bank reference rates of November 3, 2026: US$1 = ¥158.29 = A$1.4319 = £0.7457 = €0.8945. Ratios are calculated within each country before conversion. Monthly figures for Japan and Germany are multiplied by twelve and weekly figures for Australia and the United Kingdom by fifty-two. Germany's figures exclude bonuses and other special payments, but the statistics office does not separate out paid overtime. The Japanese engineer figure combines the two categories the wage survey uses for software work, programmers and systems designers, weighted by headcount, which is what the other countries' categories cover in one. The German figures use the statistics office's expert level, the grade for degree-level work: for accountants that means auditors and tax advisers, matching Japan's certified accountants and tax accountants, and for physicians it runs from doctors without a specialty to surgeons.
5. 情報処理推進機構, 情報処理・通信に携わる人材数の日米比較を追加し、「DX白書2023」印刷書籍版PDFを公開, March 16, 2023. Japan from the 2015 and 2020 censuses; the United States from the 2015 and 2021 Occupational Employment and Wage Statistics.
6. 公正取引委員会, ソフトウェア業の下請取引等に関する実態調査報告書について, June 29, 2022.
7. 厚生労働省, 解雇について（労働契約法第16条）.
8. Financial Services Agency, Administrative Actions against Mizuho Bank, Ltd. and Mizuho Financial Group, Inc., November 26, 2021.
9. 厚生労働省 COCOA不具合調査・再発防止策検討チーム, 「COCOA」の不具合の発生経緯の調査と再発防止の検討について, April 2021.
10. 接触確認アプリCOCOAの運営に関する連携チーム, COCOAの取組に関する総括報告書, February 2023.
11. 情報処理推進機構, SI事業者における脆弱性関連情報取扱に関する体制と手順整備のためのガイダンス, version 1.0, August 2005.
12. 情報処理推進機構, 「ITシステム・サービスの業務委託契約書見直しに関する調査」調査報告書, March 2020.