From our other sites
The story
GMO Internet Group’s cloud service suffered an unauthorized intrusion, and reports say someone claiming to be the attacker is attempting to hijack users’ PCs. The attacker is threatening to leak personal information—including browser history—to victims’ friends and family if their demands aren’t met, and the company has issued a warning to users. On the thread, posters repeatedly raised a technical point: the setup allowed users’ local PC drives to be accessed from the cloud virtual desktop, and many criticized GMO’s own architecture—which traded security for convenience—as the real starting point of the breach.
Attacker Targeting GMO Plots to Hijack Users’ PCs — Company Issues Warning
October 25, 2026, 16:50 [Subscriber-only article]
In the wake of the unauthorized access to GMO Internet Group’s cloud service, a standoff between the company and a person claiming to be the attacker continues.
Source: nikkei.com / Read the original article here
What people said
In Japan they'd probably just drop the charges, so they need to be tried abroad instead.
Agreed. If the culprit isn't punished, crimes like this will just keep happening.
Sounds made up, but it's actually true.
If this is really happening, wouldn't it mean not just the brokerage account but your main accounts (Google, Outlook, iCloud) got taken too?
To begin with, thanks to the standard Windows feature mentioned in Re: #22, data on the local PC gets pulled out easily.
There were probably quite a few users who installed Chrome on the virtual machine and synced it to their Google account, so everything tied to that account is compromised too.
Of course the hacker is to blame, but the guy who's been charging money for this service—GMO's "Fireball" chairman (a nickname for Kumagai Masatoshi, known for his blunt, fiery commentary)—is even worse.
What bugs me is this part from the subscriber-only article:
> They say information was stolen from users' PCs, and
> browser history and confidential information
> would be sent to friends and family.
That's the part that worries me.
GMO's admin account got stolen.
Using that admin account, the attacker freely broke into users' virtual desktops, stealing data, planting backdoors, and making unauthorized trades.
Then, when a user connected to their virtual desktop, their local PC's drive was set to be shared with the virtual desktop (GMO's default setting).
Since the virtual desktop could see into the user's PC, the cracker accessed the local machine directly, stole data, and planted a backdoor there too.
Now they're threatening that unless GMO pays up, they'll leak users' browser history and local data to everyone in their email contacts ← this is where things stand now.
It's convenient, sure, but it's a configuration that's pure security risk, so normally nobody does this. Having the service provider itself set up an access route into the customer's PC is completely out of the question.
This is entirely GMO's screwup. Not something the government needs to step in for.
If it's just the domain, this incident doesn't directly involve you. But if what the hacker is saying is true, it makes you wonder whether a company with this level of security awareness can really be trusted.
Apparently because of this whole mess, everyone's migrating over to Cloudflare now.
If everyone cancels, that's bankruptcy right there. Anyone who doesn't cancel in this situation has to be out of their mind.
Even if you wanted to cancel, the servers are probably down and the phone lines must be completely jammed.
Can't collect money from anyone, so it's just a slow death spiral.
If you try to pull small amounts from a huge pile of individual accounts, you trip the transaction-spike alerts and your precious burner accounts get frozen. But if you spread the transfers thin enough to dodge those alerts, you need a massive number of burner accounts instead. Bottom line: it's cheaper to get one rich person to wire a lump sum than to squeeze small amounts out of a ton of broke people.
Another one of Kumagai's (GMO's chairman) over-the-top soundbites.
They're still saying it now.
A private, for-profit company demanding the government use taxpayer money to protect the customer data and assets that it itself collected.
A normal, sane company spends its own time, money, and manpower to strengthen its own security.
Even with AI, it's long been said offense has an overwhelming advantage over defense, so going on the offensive for the sake of defense actually makes sense to me.
Customer PCs are already hijacked and can become zombie machines at any moment. This is the kind of thing where the police show up at your door out of nowhere one morning.
Exactly this. If the hacker actually wants money, hijacking GMO's own internal PCs and exposing their staff's personal info would be way more effective than this. Just hijacking customer PCs doesn't actually hurt the company itself. Are hackers just not that bright?
Just finding a security setup this full of holes is bad enough on its own.
Background and Key Points of This Story
GMO Internet Group provides a virtual-desktop-style cloud service used for things like securities trading, and in this incident it appears administrator privileges were seized by the attacker. As pointed out on the thread, if the setup really did allow users’ local PC drives to be accessed from the cloud virtual desktop, that’s an unusual configuration for a remote environment, and a design that prioritized convenience may well have been the starting point for the breach. On the ransom demand being limited to roughly 100 million yen, two views coexist: one that reads this as proof the attacker couldn’t extract large sums from users at scale, and another that worries individual PCs may still remain compromised. The actual scope of the damage had not been confirmed as of this writing.
*This article is excerpted and summarized from the 5ch (News Express+) thread “Attacker Targeting GMO Plots to Hijack Users’ PCs — Threatens to Leak Personal Information to Ramp Up Pressure, Company Issues Warning.”
Leave a Reply