In brief
The breach exposed customer data on GMO’s foreign‑exchange service and a threat of ransomware, with experts noting that a victim‑information site appeared only two days before the public disclosure and shares design and code with the claims site. The analysis implicates the attacker in a strategy to harvest victim data, but no confirmation has been made by GMO, and the true motive remains uncertain.
Security experts say the attacker behind a recent cyber‑attack on GMO Internet Group Inc. may have created a victim‑information‑sharing website to harvest data from customers, according to analysis published by Kyodo News. The breach, first disclosed by GMO, involved unauthorized access to customer information for its foreign‑exchange trading service and the threat of a ransomware attack. The analysis points to a new website that was registered only two days before the breach was publicly announced, suggesting a deliberate effort by the attackers to collect victim data and coordinate claims.
In a July 2023 incident, GMO confirmed that customer information was leaked without authorization and had been used in fraudulent transactions. The hacker threatened to disclose additional customer data and to conduct a ransomware campaign against the firm. The company did not reply to media inquiries, and on a Tuesday following the announcement, some customer information was reportedly disclosed.
The newly identified victim‑information‑sharing site, which was registered on October 19, shares a design and source‑code structure remarkably similar to the site that the hacker used to claim responsibility for the breach. Security experts say the two sites are “pretty much identical.” One of the experts explained that such a close resemblance could indicate that the attacker is using the site to farm victim information and to coordinate further malicious acts.
“They are pretty much identical,” one of the experts said.
The victim‑information‑sharing forum became publicly available on October 22, according to the analysis. The timing of the site's registration—just two days before the breach announcement—and its striking similarity to the attacker's claim site suggest a coordinated effort to mobilize victims and extract sensitive data for potential ransom or further exploitation.
Background on GMO and the Breach
GMO Internet Group Inc. is a major Japanese internet infrastructure provider that operates a range of services, including foreign‑exchange trading. In the weeks leading up to the breach, the company announced that customer data had been exposed by unauthorized access. Security analysts noted that the leaked data could be used for fraudulent transactions, as was indeed reported in subsequent investigations.
In response to the incident, GMO issued a public statement confirming the breach and noting that it had not yet released any personal data to the attackers. While the company withheld a full response to questions on the scope of the breach, it reported that some customer information had been disclosed to the public on a Tuesday following its initial announcement.
The threat of a ransomware attack was also part of the hacker’s communication, underscoring the potential for significant damage to both the company and its customers. The nature of the threat—whether it was a genuine plan or a bluff—remains an open question, as no confirmation of a ransomware attack has yet emerged.
Analysis of the Victim‑Sharing Site and Open Questions
Experts note that the timing and structure of the victim‑information‑sharing site fit a pattern seen in other cyber‑campaigns where attackers create forums to gather victim data, exchange information, and coordinate demands. The fact that the site was registered only two days before the public breach announcement raises questions about the relationship between the attacker’s initial intrusion and the later use of the forum.
One possibility, as indicated by the security analysis, is that the attackers set up the forum to harvest victim credentials, personal data, and other sensitive information that could be leveraged in subsequent fraud or ransom demands. The existence of the claim site—an earlier footing used by the attackers to announce the breach—makes the suspect that the same individuals or group controlled both sites.
Nevertheless, certain aspects remain unclear. The degree to which the victim‑information‑sharing site was operationally used to collect data on GMO’s customers is unknown, as is the extent to which the attackers managed to convert harvested information into actionable intelligence. Additionally, the true motive behind the attackers' demand for ransom or threat of further disclosure has not been fully articulated by either the attackers or GMO.
GMO has not publicly responded to in‑depth questions about the incident beyond its initial statement. While the company acknowledged its customers’ exposed data, it has not confirmed whether the information sharing forum was actively used to target them or whether any ransom was actually demanded or paid. The ongoing investigations by security specialists will likely clarify the mechanisms used by attackers and could shape future remedial measures for the company.
Security professionals caution that the rapid creation of a victim‑information‑sharing site immediately preceding the breach announcement may be a strategy to confuse investigators and to buy time for the attackers to conceal their actions. The potential for a coordinated ransomware attack, suggested by the hacker’s threat, emphasizes the need for heightened vigilance among users of GMO’s foreign‑exchange service and for firms to strengthen incident‑response protocols.
In summary, the discovery of a near‑identical victim‑information‑sharing website registered before the public breach announcement raises serious questions about the tactics used by the attackers and the vulnerability of personal data within GMO’s services. The analysis points to a deliberate effort to harvest valuable information from victims, possibly in preparation for a ransomware attack or for use in fraudulent transactions. As more details emerge—particularly from GMO’s own security responses and from independent investigations—industry stakeholders will likely reassess defensive measures against similar threat actors.
