Overview
- S&J’s forensic review found the victim‑forum domain was registered on Oct. 19, two days before GMO publicly disclosed unauthorized access, and the site has since been taken down.
- The now‑defunct portal invited people affected by the breach to ‘share information,’ and suspicious social accounts repeatedly pushed links to the site to gather and amplify victim reports.
- Investigators say the forum was hosted on the same U.S. server and shared structural and code similarities with earlier extortion postings, linking the portal to the actors behind the ransom demands.
- GMO has scheduled a public update by chairman Masatoshi Kumagai and is working to verify leaked material, restrict affected accounts, reimburse customers and continue forensic and law enforcement cooperation.
- Security firms warn the site shows premeditated tradecraft that weaponizes victims to increase leverage, a tactic that raises fraud risks for customers and could shape criminal and regulatory responses.