GMO GlobalSign: GMO Trust Login customer files open to outside retrieval

1. 2017-11-14

   To ease the load of serving logo images, it turned part of its storage into a public area. Files with customer data were stored there too, and anyone could list them and fetch each one. [1]

2. 2021-06-08

   Access logs show third parties fetching files from this date; earlier logs do not exist, so the earlier years are treated as possibly affected. [1]

3. 2026-09-14

   At 17:48 an outside researcher reported the problem through its vulnerability reporting program. From about 23:45 to 16:00 the next day it blocked retrieval step by step. [1]

4. 2026-09-16

   It published its first report and began contacting the administrators of affected companies. [1]

5. 2026-10-23

   GMO Cybersecurity by IERAE finished its review of the access logs and settings. [1]

6. 2026-10-30

   Its third report at 15:00 raised the count from 2,007 companies and 37,747 people to 2,492 companies and 45,030 people and set out the cause and fixes. It calls this its final report on the findings. [1] [2]

Files the system created when administrators made bulk changes, and the company's own contract files, were taken. They held email addresses, names, linked app names and custom fields such as staff numbers and departments of 44,836 users at 2,184 companies, and names, addresses, phone numbers and email addresses of 194 billing contacts at 217 companies. Another 91 companies cannot be identified because their administrator accounts were deleted. Login passwords, multi-factor data, passwords of linked services and payment data were not included. [1] [2]

It blames a design that put temporary files with customer data in the public logo area, file links without signatures or expiry, and regular security tests that left storage out. It deleted the files, closed file listing on all storage and added constant monitoring of settings. Most fixes are due by 30 November 2026; common handling of temporary files is due by 31 January 2027. It plans to file its final report with the Personal Information Protection Commission on 12 November. [1]