GMO Internet confirmed Oct 20 that an outsider installed unauthorized programs on some customers' FX trading VPS servers; 26,739 servers may be affected and all are being stopped from Oct 21 04:00 JST. Change any passwords used on the server.
What to do: Oct 24 (GMO, 11:50 JST): a suspected attacker demanded money and threatened to publish data; GMO refuses to pay. Customers report trades they did not make at more than 70 securities and FX firms. GMO will cover confirmed losses and pay every current customer 5,000 yen, and will not restore the old system. Police consulted Oct 22; GMO calls this the first activation case for Japan's new active cyb…
A cloud VPS service from Japan's massive GMO Internet Group used by foreign-exchange traders has been hacked. Attackers breached the servers, stole customer credentials, and executed balance-destroying trades across over 70 brokerages. GMO has asked government agencies for help.
Customer posting the GMO Onamae.com email to Desktop Cloud users: full virus scan, back up data, change FX and email passwords, turn on multi-factor login, remove suspicious linked apps and devices, stop browser sync.
[Important] Current response to the unauthorized access to Onamae.com Desktop Cloud (7th report) (translated from Japanese)
【重要】不正アクセスに関する現在の対応について（第12報）更新しました ①今後の対応方針 ②「GMO特別お見舞金」（1公開につき上限300万円）について ③【総額100万ドル・総額1.5億円】 「GMOサイバー犯罪撲滅・懸賞金 」について
【重要】「お名前.com デスクトップクラウド」への不正アクセスに関する現在の対応について（第8報） （ 【続報】お客様をお守りするために現在私たちが行っていること） （【緊急】本日12時の攻撃に備え、お客様に新規のお願い_ネットワーク切断、電源断）
日本だけではありません「国際刑事警察機構INTERPOL」にも相談済みです。 【速報】GMO不正アクセス問題、警視庁が捜査 #47NEWS @47news_officialより
Why this score
Raised to 8 (verified sweep, Oct 25): ransom demand, unauthorized trades at more than 70 brokerages, losses covered, government asked to act