GMO Internet Says Cloud Breach Put 26,739 Servers at Potential Risk

GMO Internet said an attack on Onamae.com Desktop Cloud put 26,739 servers at potential risk, while customers reported unauthorized trades through brokerage accounts hosted there.

The company described the figure as servers that may have been affected, not a count of confirmed compromises. GMO said an attacker exploited a security issue, installed malicious software in some customer server environments and took customer information.

GMO began investigating after a customer inquiry Oct. 19 and found malicious software the next day. It started shutting down all plans at 3 p.m. EDT Oct. 20 (19:00 UTC).

Some customers reported trades made without their authorization using tools running on the service. GMO said a person it believes was behind the intrusion demanded money and threatened more account orders against users at more than 70 securities and foreign-exchange firms, as well as data releases and ransomware. Those were threats, not confirmation of activity across those firms.

GMO rejected the demand, saying payment could not guarantee the information would not be misused. Onamae.com Desktop Cloud hosts brokerage software such as MetaTrader 4 and MetaTrader 5 on customer servers.