Hacker Trades in Victims’ Accounts, Then Tries to Extort GMO
GMO Internet says an attacker who breached Onamae.com Desktop Cloud used stolen logins to trade in customers' brokerage accounts and is now demanding money. GMO won't pay.
GMO Internet is refusing to pay an extortionist who broke into its Onamae.com Desktop Cloud service and, the company says, used what it found to place trades in customers’ brokerage and FX accounts. In an Oct. 24 notice, GMO says the attacker demanded money and threatened to keep manipulating accounts at more than 70 securities and FX firms, leak data and launch ransomware against customers’ PCs. The whole service, 26,739 servers across all plans, is offline, and GMO says it won’t bring the old platform back.
For defenders
What GMO has confirmed: Desktop Cloud rents Windows desktops that many customers use to run trading tools around the clock. After a customer inquiry on Oct. 19, GMO Internet found on Oct. 20 that a third party had installed an unauthorized program on some customers’ servers. It froze the control panel that day and began shutting down every plan from 4 a.m. on Oct. 21. Its Oct. 23 notice says trading-account logins and other data stored on the servers may have been stolen and used, and the Oct. 24 notice confirms a security problem in the service’s own system and that customer information left the environment. Customers have reported trades they didn’t make.
What isn’t known: GMO hasn’t disclosed the intrusion route, the program used, the size of the demand or who’s behind it. The 26,739 figure is servers that may be affected, not confirmed compromises. GMO says it doesn’t store payment card data on the service, but anything customers kept on their servers is in scope. The threats to leak data and deploy ransomware are the attacker’s claims, and GMO warns that anything leaked may not be accurate.
Response: GMO has gone to the police, asked exchanges and brokers to block access coming from the service and cut active sessions, and asked Japan’s government to treat the case as the first use of its new Active Cyber Defense powers. It’s offering every current user ¥5,000, six months free on a replacement platform, and compensation for realized losses from trades it confirms were unauthorized.
What it means for you
This attack went after money, not just data. If you ran a trading platform such as MT4 or MT5 on a rented cloud desktop, whoever took over that desktop could also log in to your brokerage account and trade with your money. GMO also says it will never ask for your passwords or PIN during the compensation process, so treat any message that does as a scam.
Do this now
- If you used Onamae.com Desktop Cloud, change the passwords for every trading account and tool you used there, from a different device, and log out all active sessions.
- Turn on two-factor authentication at each broker and exchange, then check your trade history and balances for anything you didn’t do.
- Report any unauthorized trades to the broker right away, and keep records for GMO’s compensation claim (details due by Nov. 6).
- Whatever host you use, don’t save trading or banking logins on a shared or rented machine unless the account has two-factor authentication turned on.