GMO's Kumagai apologizes: checking the 2024 warning, the North Korea theory and full compensation
At his first press conference on the unauthorized access, GMO Internet Group Chairman and CEO Masatoshi Kumagai apologized on November 2 and admitted that group experts had flagged problems with the system in April 2024. GMO says it will fully compensate losses from fraudulent FX trades. Reports of North Korean hackers, however, reflect GMO's analysis and have not been confirmed. We sorted out what the press conference and reports establish.
Verdict: are the viral claims true?
- True“GMO had been warned about the vulnerability in 2024”At the press conference, GMO admitted that experts at its group security firm, GMO Cybersecurity by Ierae, had flagged problems with the system in April 2024. Kumagai said the company "could not put this warning to use in running the service."
- Misleading“GMO did nothing after the warning”GMO said it carried out four emergency maintenance operations in April and May 2024 after the warning. It admitted, however, that those measures were "lacking in both depth and speed." It did act, but not enough.
- Unverified“The attack has been confirmed as the work of North Korean hackers”Kyodo News reported on November 1, citing sources, that GMO believes North Korean hacker groups are likely involved and reported this to the government. But a GMO executive described it as a possibility under investigation, and neither the police nor the government has named the attacker.
- True“Losses from fraudulent FX trades will be fully compensated”GMO said at the press conference that it will fully compensate users who lost money through fraudulent FX trades. It will also pay every user ¥5,000 regardless of damage, and up to ¥3 million to people whose information was published.
Translated and adapted from our Japanese original. Facts are as of the original publication date unless noted.
Key points
- At his first press conference since the problem came to light, GMO Chairman and CEO Masatoshi Kumagai apologized on November 2, saying, "We were unable to protect our customers."
- The attacker broke into a user's virtual server on August 5 and stole administrator privileges. GMO only became aware on October 20, about two and a half months later.
- GMO will fully compensate FX losses and says it will never pay the ransom. North Korean involvement has been reported but not confirmed.
1. What is happening
This is a follow-up to “GMO hack: experts narrow down the attacker from the extortion site’s logs, but no one has been identified”.
Kumagai apologizes at his first press conference
On the afternoon of November 2, GMO Internet Group Chairman and CEO Masatoshi Kumagai held his first press conference on the unauthorized access to “Onamae.com Desktop Cloud,” a cloud service for FX traders.
Kumagai apologized for the leak of users’ information and the loss of their assets, and bowed, saying, “We were unable to protect our customers, and we are truly sorry.” He also apologized for his own posts on X, including touching on matters involving victims and posting a photo of himself smiling, saying they “lacked consideration.”
The 2024 warning and what followed
GMO admitted that in April 2024, experts at its group security firm, GMO Cybersecurity by Ierae, had flagged problems with the system.
According to Nippon TV, GMO carried out four emergency maintenance operations in April and May after the warning, but said the measures were “lacking in both depth and speed.” Kumagai also said the problem had never been reported to him and that he learned of it from this incident.
Intrusion in August, noticed in October
The timeline given at the press conference:
- August 5: The attacker broke into a user’s virtual private server (VPS) and later stole the service’s administrator privileges.
- September 20 to October 14: Malware was distributed to users’ virtual servers through the hijacked management server. Up to 26,739 machines could have been affected.
- October 19-20: GMO began investigating after a customer inquiry and became aware of the damage on October 20.
Compensation and payments
What GMO told users at the press conference:
- Users who lost money through fraudulent FX trades: full compensation.
- All users: ¥5,000 regardless of damage, plus a replacement service free for six months.
- People whose information was published: up to ¥3 million, depending on the information.
Kumagai and three other executives will take pay cuts of up to 30% for three months starting with December pay. GMO said it will reconsider management responsibility based on the results of its review.
How solid is the “North Korean hackers” theory?
On November 1, Kyodo News reported, citing sources, that GMO believes North Korean hacker groups are likely on the attacking side and reported this to the government. The judgment appears to be based on features of the malware and other traces. In Kyodo’s own analysis with security experts, five of the IP addresses that connected right after the extortion site went up matched ones previously used by North Korean hacker groups.
However, the extortion site also carried traces linked to several countries, including the U.S. and Japan, which may have been meant to confuse investigators. A GMO executive told TBS that the company is investigating “including” the possibility of North Korean involvement, so it is not confirmed. As noted in our previous article, some experts see the attacker as an “amateur.”
Kumagai has described the spread of information online as “cognitive warfare” by the attacker in posts on X. At the press conference, he said this was his personal view, not the company’s.
What is still unknown
- Who the culprit is: The bounty has drawn about 700 tips, and GMO has given police information it believes will help identify the culprit. But as of the night of November 2, police had not announced an identification or arrest.
- When and how payments will be made: Users will need to wait for further notices.
Sources (mostly in Japanese)
2. What each side says
We summarize each side's main arguments in our own words, based on the original statements and reporting.
Credit for GMO's explanation and response
Kumagai said GMO will fully compensate FX losses, pay every user ¥5,000 and pay up to ¥3 million to people whose information was published. A replacement service will be free for six months.
On the attacker's demand of about ¥8 billion, Kumagai repeated that GMO will never pay, saying, "Their biggest goal is money. We will not encourage that."
GMO said its bounty for information leading to the culprit had received about 700 tips by the day of the press conference.
Holding GMO strictly responsible
Kyodo News reported that GMO left the vulnerability flagged by in-house experts in April 2024 unaddressed for more than two years, and said criticism of the slow response is inevitable.
Before the press conference, Kumagai had denied on X, as "not true," reports that GMO ignored a vulnerability report. At the press conference, the company admitted it had been warned by group experts.
Kumagai said the security problem behind the attack had never been reported to him and that he learned of it from this incident, which suggests management oversight did not reach it.
3. Where things stand
Where they agree
- GMO will fully compensate losses from fraudulent FX trades.
- GMO will not give in to the attacker and will not pay a ransom.
- It is better not to spread, or go looking at, the purported personal data.
Where they disagree
- Whether the response to the 2024 warning should be called "ignoring it" or "insufficient measures."
- Whether the pay cut (30% of Kumagai's monthly pay for three months) is an adequate way to take responsibility.
- Whether the analysis pointing to North Korean hackers or the experts calling the attacker an "amateur" is closer to the truth.
What to watch
- Whether the Tokyo Metropolitan Police identify or arrest the attacker, and whether the government says anything about North Korean involvement.
- The results of GMO's upcoming review and any further decisions on management responsibility.
- When and how compensation and payments will be made.
At the press conference, GMO admitted that it was warned about a vulnerability in 2024 but did not do enough, and promised full compensation for FX losses. It did not "do nothing," but it took two and a half months to notice the intrusion, and the problem had never reached the top. North Korean involvement has been reported as a strong possibility but is still at the analysis stage. Who the culprit is will depend on the police investigation.