GMO Internet: unauthorized access to Onamae.com Desktop Cloud

On 20 October GMO Internet found that a third party had placed a malicious program on some customer servers of Onamae.com Desktop Cloud, its Windows remote desktop service. 26,739 servers may be affected, and it began shutting down servers on all plans from 04:00 on 21 October. Login details for trading tools such as FX platforms saved on the servers were used, and customers reported trades in their accounts that they had not made. Its fourth report on 24 October admitted a security flaw in the service's systems and confirmed customer data was taken out. It will pay every user a flat ¥5,000, compensate realized losses from unauthorized trades and offer a replacement service free for six months. It consulted the police and asked the government to respond with active cyber defence measures. On 25 October group chairman and CEO Masatoshi Kumagai apologized on his blog, admitting that in-house engineers had raised security issues with the service that were not dealt with in time. The damage may reach users' own PCs. According to GMO's user guide, the RDP connection files it handed out turned on file sharing with the user's PC by default, which lets the server side see the drives of the user's own computer. From 25 October GMO collected users' PCs across Japan for analysis; its ninth report at 11:59 on 27 October said no malware had been found on the devices analysed so far. GMO's timeline says a threatening email on 21 October demanded about ¥8 billion. Kumagai wrote on his blog on 26 October that the demand was USD 50 million in crypto assets (Sankei Shimbun). The apparent attacker later demanded USD 1 million by noon on 27 October and threatened to publish users' data and launch ransomware attacks if not paid (ITmedia NEWS). TV Asahi reported the attackers claim to have planted a backdoor that lets them back into users' PCs without logging in; this is an unverified claim, and GMO has not confirmed any intrusion into users' PCs. GMO says it will not pay. Its eighth report on 27 October asked users to back up their data, disconnect their PCs from the network and switch them off before noon, and it will give users hit by ransomware an equivalent new PC. According to its tenth report, at 12:30 on 27 October GMO confirmed that the apparent attacker had published information it claims concerns GMO and its customers. GMO is checking the content, warns it may contain false information, asks people not to access or share it and is preparing legal action against malicious spreaders. It will contact customers whose data is included and is considering steps beyond the flat payment. As of 13:55 no ransomware attack had been confirmed. Its eleventh report at 14:55 said it had confirmed that the attacker collects data on anyone who visits the attacker's site, repeated its request not to visit it and advised those who had to run a full antivirus scan. On 27 October Financial Services Minister Katayama named five FX firms that reported customer damage thought to be linked to GMO: Goldenway Japan, OANDA Securities, AvaTrade Japan, Gaitame Finest and Dukascopy Japan. Trading account logins stored on the servers appear to have been taken and used for unauthorized trades. The firms suspended trading for affected customers and blocked unauthorized orders. Amounts were not disclosed. The Goldenway Japan case is covered as a separate incident.