GMO tells account holders to prepare for worst as hackers threaten exposure

GMO Internet Group was on high alert after a hacker group threatened to expose the personal information of its clients and launch a ransomware attack on Tuesday at noon. The group asked GMO account holders to back up their data and unplug their computers before noon.

The extreme request highlights GMO’s bid to minimize the impact from the potential attack.

“Before 12 p.m. on Tuesday, Oct. 27, please back up (data), cut off the internet, shut down the computer and pull the plug connected to the computer,” GMO said in a statement on Tuesday.

GMO has said that it will not comply with the attackers’ request to pay about ¥8 billion ($51 million), adding that there is no guarantee the group would delete the personal information taken and that the stolen information might still be used for unlawful purposes.

After the noon deadline, the hacker group said it had disclosed information on one client as GMO has refused to negotiate, NHK reported.

The company announced last week it experienced a security breach that potentially affected its 26,739 servers involving customers’ trading accounts at more than 70 securities firms, foreign-exchange providers and other businesses in Japan and overseas.

More financial damage has been reported after initial reports that some users have lost nearly ¥2 million. On Tuesday, Finance Minister Satsuki Katayama said the servers for five foreign exchange margin-trading services related to GMO have been breached, with the attacker making unauthorized trades online.

The five companies — Goldenway Japan, Oanda, Ava Trade Japan, Gaitame Finest and Dukascopy Japan — have already suspended trades for those account holders, she said.

GMO has been analyzing some of its client’s computers to see how hackers are going into the system, and to create countermeasures.

The company has pledged to compensate victims for their losses, in addition to a blanket ¥5,000 payout for all users.

Other cybersecurity and artificial intelligence companies, including Trend Micro, have been helping out GMO in countering the attackers.

GMO has also urged the government to launch its cyberdefense measures.

“Now is the time to protect Japan — and the internet — through public–private cooperation,” GMO CEO Masatoshi Kumagai wrote in a blog post Sunday, adding that in his assessment, “the internet itself is now on the verge of breaking down.”

Prime Minister Sanae Takaichi, meanwhile, instructed her government on Monday to compile a package of cybersecurity measures by the end of next week.