GMO hack: experts narrow down the attacker from the extortion site's logs, but no one has been identified
In the unauthorized access to GMO's cloud service for FX traders, the attacker's extortion site left a record of its visitors, and experts narrowed down IP addresses likely used by the attacker, TBS reported. Claims that "the attacker's account was exposed" or "the culprit has been identified" are also spreading, but neither the police nor GMO has announced an identification or arrest. We sorted out what can be confirmed from the reports and GMO's announcements.
Verdict: are the viral claims true?
- Misleading“TBS's report exposed the attacker's account”According to the tabloid Yukan Fuji (zakII), the name of an X account that spread the extortion site's URL appeared unblurred in TBS's October 30 broadcast and was blurred on October 31. An expert linked the account to the attacker, but it has not been confirmed that its owner is the attacker, and it may have been hijacked.
- Unverified“The culprit has already been identified”An expert says he passed information on "people who may be the culprit" to GMO, but as of the night of October 31, neither the police nor GMO had announced an identification or arrest.
- True“GMO gave police information to identify the culprit”On October 29, GMO announced that its group's white-hat hacker team had obtained information it believes will lead to identifying the culprit and would submit it to the police and others. It has not disclosed the contents.
- True“A GMO subsidiary had warned of the vulnerability”According to Nikkei, citing a GMO executive, a GMO security subsidiary had pointed out a vulnerability in the system as of April 2024, but sufficient action was not taken.
Translated and adapted from our Japanese original. Facts are as of the original publication date unless noted.
Key points
- The attacker's extortion site left a publicly visible record of its visitors, and experts narrowed down IP addresses likely belonging to the attacker, TBS reported on October 30.
- Takayuki Sugiura, head of the Japan Hacker Association, says he gave GMO information on "people who may be the culprit," including names and addresses. But neither the police nor GMO has announced an identification or arrest.
- GMO Chairman and CEO Masatoshi Kumagai will hold a press conference on November 2 to explain what happened and how customers will be treated. It has also been reported that a subsidiary flagged a vulnerability in 2024.
1. What is happening
This is a follow-up to “GMO ransom demands: ¥8 billion vs ¥160 million, and the real hostages”.
What was found
In the unauthorized access to GMO Internet’s FX cloud service “Onamae.com Desktop Cloud,” the attacker ran an “extortion site” announcing that it would publish user data every day at noon. The site’s domain was suspended on the morning of October 28, and it can no longer be viewed.
On October 30, TBS reported that the site had left a record of its visitors in a publicly visible state. According to a specialist at security firm Unknown Technologies, the attacker published it unintentionally.
Right after the site’s files were edited, IP addresses (numbers that work like addresses on the internet) with a characteristic pattern visited repeatedly. The specialist concluded that the attacker came to view the site and “left footprints,” and says three IP addresses are “strongly presumed” to have been used by the attacker.
Information on “people who may be the culprit” passed to GMO
Takayuki Sugiura, head of the Japan Hacker Association, which is cooperating with GMO, says he analyzed the records using a different method and has already sent GMO information on “people who may be the culprit,” including contact details, addresses and names.
On October 29, GMO announced that its group’s white-hat hacker team had obtained information it believes will lead to identifying the culprit and would submit it to the police and others. It has not been made clear whether Sugiura’s analysis and the information GMO gave the police are the same.
What is still unknown
- No identity has been disclosed. The recorded IP addresses, locations and names have not been made public.
- An IP address does not necessarily point to the person. Traffic routed through overseas servers records a different location’s address. The same specialist also believes the attacker usually connected through virtual servers.
- The police have not announced an identification. The Tokyo Metropolitan Police are investigating on suspicion of violating the Unauthorized Computer Access Act, among other things, but as of the night of October 31 no identification or arrest had been announced.
Some people have taken the report to mean that “TBS exposed the attacker’s account.” According to Yukan Fuji (zakII), TBS’s October 30 evening news blurred the visitors’ IP addresses but left visible the name of an X account shown just below them. The program said this account spread the site’s URL a few minutes after the attacker checked the site from their own connection. In the October 31 broadcast and the online video, that part was blurred as well.
However, it has not been confirmed that the account’s owner is the attacker. The account had been dormant and suddenly became active in early October, so it may have been hijacked. GMO has also asked people not to try to identify the culprit themselves or post unconfirmed information.
Kumagai to hold a press conference on November 2
On October 31, GMO Internet Group announced that Chairman and CEO Masatoshi Kumagai will hold a press conference on November 2. The president of GMO Internet will also attend, and they plan to explain how the unauthorized access happened, how customers will be treated, and what the company will do next.
Citing a GMO executive, Nikkei reported that a GMO security subsidiary had pointed out a vulnerability in the system as of April 2024, but sufficient action was not taken.
Sources (mostly in Japanese)
2. What each side says
We summarize each side's main arguments in our own words, based on the original statements and reporting.
Hopeful about tracking the attacker
Takayuki Sugiura, head of the Japan Hacker Association, says the attacker is not a professional cybercriminal and left many gaps and traceable clues, and that there is "a high chance they will be caught."
A specialist at security firm Unknown Technologies analyzed IP addresses that visited right after the site's files were edited and concluded that the attacker "left their own footprints." The specialist says three IP addresses are "strongly presumed" to have been used by the attacker.
GMO says it has obtained, from tips and its own white-hat team, information it believes will lead to identifying the culprit, and is submitting it to the police and others. Its bounty desk had received 428 tips as of 6 p.m. on October 30.
Cautious, or questioning GMO's responsibility
GMO itself has asked users and the public not to try to identify or contact the culprit on their own, and not to post unconfirmed information.
According to Nikkei, a GMO security subsidiary had pointed out a vulnerability in the system as of April 2024, but sufficient action was not taken.
3. Where things stand
Where they agree
- Identifying and arresting the attacker is up to the Tokyo Metropolitan Police investigation.
- It is better not to spread, or go looking at, the purported personal data or the attacker's site.
Where they disagree
- How far private experts' analysis should be taken as "closing in on the culprit."
- Whether to focus on tracking the attacker or on GMO's responsibility for failing to prevent the damage.
What to watch
- How the November 2 press conference explains the response to the vulnerability warning and compensation for customers.
- Whether the Tokyo Metropolitan Police identify or arrest the attacker.
TBS did report that experts used visitor records left on the extortion site to narrow down IP addresses likely used by the attacker. But that is a private analysis, and it does not mean "the account was exposed" or "the culprit was identified." It has also been reported that a GMO subsidiary flagged a vulnerability two years ago. How close the attacker is to being caught, and why the damage was not prevented: the November 2 press conference is a chance to check both.