Website used by hackers to leak info shut down, GMO says

GMO Internet Group announced Wednesday that it had confirmed the shutdown of a website used by cyberattackers to leak data allegedly stolen in a breach potentially affecting more than 26,000 of the company’s servers via its domain registration service Onamae.com.

The standoff between GMO and an anonymous hacker group came to a head on Tuesday when the hacker group published personal information purportedly belonging to a GMO client on its website. The profile included identifying details such as the individual’s photograph, name and address, as well as information about their online activity, including their shopping habits and the financial institutions and services they use.

The attackers had demanded a $1 million ransom in exchange for not publishing the leaked information. After GMO refused to pay, the hacker group published the purported GMO client’s information on its website and threatened to publish another user’s private information each day until the ransom is paid.

In response, GMO announced a bounty of up to $1 million for information leading to the hacker group’s arrest and launched a website on Wednesday to collect leads. The website says the company is seeking information on those involved in the attack, the infrastructure they used, including connected servers and IP addresses, the movement of funds, and evidence pointing to the criminals’ methodology.

In a news release released on Wednesday, GMO warned that new websites could emerge even though the attackers’ original domain had been shut down.

“Should the original website or any new websites emerge, we will respond firmly to particularly malicious acts involving the posting, reproduction, or dissemination of information published on those sites. This may include legal action such as filing criminal complaints,” GMO said.

“In particular, directing people to the attackers’ website is a serious act that could be interpreted as encouraging the attackers and assisting their activities.”

Over the weekend, GMO asked the Japanese government to take active cyberdefense measures against the attackers. The government has declined to comment on any specific response to the GMO case, citing security concerns in revealing the status of investigations and noting that decisions on whether to neutralize attackers’ infrastructure rest with the relevant authorities.

According to news reports, the Metropolitan Police Department is currently taking protective measures to ensure the safety of those of GMO’s clients affected by the data breach.