Japanese Cloud Desktop Provider Breached, Putting Customers' Trading Accounts at Risk

GMO Internet, a Japanese internet service provider, has warned customers that its Onamae.com Desktop Cloud service was compromised. The service provides cloud-hosted Windows desktops, which the company recommends for running foreign exchange trading applications. GMO first said a third party had installed malicious programs in some customers' server environments. It later admitted its systems had security vulnerabilities, that its environment was accessed without authorisation, and that customer information was taken outside the company.

The impact has reached customers' money. Some users reported unauthorised operations and transactions they did not recognise in their trading accounts, and GMO said attackers had probably seen trading passwords. Customers were told to change their passwords straight away, using a device they do not use for trading. GMO also asked major trading services to end all active sessions, watch for unauthorised transactions and block trade requests coming from the service. Up to 26,739 virtual desktop servers may have been affected, and users' personal devices may also be at risk.

GMO said it received a demand for money from a person believed to be the attacker, who threatened to publish information about the company and its customers if it refused. The company will not pay, because paying would not guarantee the data is deleted or that misuse is prevented. Investigations continue. GMO is offering every user a ¥5,000 ($32) payment and has promised to cover any trading losses caused by the attack.