Overview
- GMO held a public apology on Monday and confirmed attackers first entered customer servers on August 5, with the company detecting malicious activity on October 20 and suspending the service the next day.
- Attackers demanded a $50 million ransom and posted customer data on October 27 after GMO refused to pay, prompting reports of unauthorized FX trades and individual losses of hundreds of thousands of yen.
- GMO announced a uniform 5,000-yen goodwill payment to all users and said it will fully reimburse losses that are confirmed to result from the breach.
- The company admitted that internal cyber experts had flagged system issues that were not implemented, and it pledged a third-party forensic probe, a reward program to identify the attackers and temporary reductions in executive pay.
- The breach highlights risks in VPS setups where user-managed features such as remote desktop access can be exploited, and it raises questions about cloud-provider governance, customer safeguards and the pace of compensation and investigation.