Overview
- GMO says attackers breached customer servers on August 5, gained administrator access, posted a ransom demand and later reduced the demand from about ¥8 billion to $1 million while threatening to publish customer data.
- At a November 2 press briefing, CEO Masatoshi Kumagai apologized but focused on long statements about corporate philosophy and provided few new technical details, prompting criticism from journalists and security experts.
- GMO has offered a reward for information, submitted its analysis to authorities and closed the site used by the attackers while refusing to pay the ransom.
- Security researchers see malware traits and some IP addresses similar to past attacks linked to North Korea but warn the evidence is not conclusive because signs of sloppy tradecraft and possible false-flag tactics leave attribution uncertain.
- Reports that a subsidiary flagged a vulnerability two years ago and that fixes were not completed have raised fresh questions about the company’s cyber governance and will shape ongoing probes and any regulatory review.