From our other sites
The story
After GMO refused a hacker group’s monetary demands, the personal information of one customer — singled out as an example of what happens when you don’t negotiate — was published online. The leaked data is said to include partial names, phone numbers, family members’ names, movement patterns, LINE and Yahoo account details, a face photo, a driver’s license, and a My Number card (Japan’s national ID), among other things. As for the cause, information circulating online suggests that a canceled cloud server was left running until a new customer took it over, and the leftover data sitting on it was scooped up wholesale. On 5ch, opinions split between shock at the technical backstory of the leak, debate over whether GMO should have paid the ransom, and disagreement over whether GMO or the hackers bear the real responsibility.
What people said
Yeah, it's pretty detailed — name, phone number, the son's full name, movement patterns, LINE account, Yahoo account, even a face photo.
Is this an executive's info, or just a regular member's??
But in Japan the payout probably won't amount to much, so it's fine, it's fine. In America they'd probably get hit for hundreds of millions of yen per person though.
Did someone connected to GMO just get thrown under the bus?
Apparently they're planning to drip-feed it out slowly over several years.
Maybe about a year of litigation for something like 500,000 yen (~$3,300)?
Sounds like Megaten (a nod to the game series' iconic "turn off the power" warning)
This is the explanation for "why a canceled account got targeted."
Normally, when you cancel a cloud service, the data is supposed to be wiped completely (reset) right away.
But apparently, to save costs and skip the hassle of reprovisioning, GMO kept the server running for months after cancellation until a new customer signed up for it.
As a result, data belonging to users who'd canceled months earlier and thought they were safe was still sitting live on the server — and the attacker scooped it all up in one go.
Left running until the next customer… wait, does that mean they're reusing the same environment?
And this company calls itself an IT infrastructure provider? 🤔 That's hilarious.
Wait, so does that mean the next customer could actually read the previous customer's data?
But even with thousands or tens of thousands leaked, nobody's actually going to bother digging through it to identify people, so this approach isn't bad either, is it? Would be kind of interesting if they ramp it up next time — 2 people, then 4, and so on.
ps://i.imgur.com/u8W347C.jpeg
ps://i.imgur.com/NPFduqI.jpeg
ps://i.imgur.com/Hy7aq6l.jpeg
ps://i.imgur.com/WFC1SKO.jpeg
GMO opens cyberattack "analysis and defense" center, gathers 200 white-hat hackers
https://news.ntv.co.jp/category/economy/8da5a651ef064cb186551a1fc1cc68be
Looks like the shot you'd get if some amateur director was told "film a scene where a company gets hacked" for a movie.
The theory that the perpetrator is Japanese and this is personal revenge is gaining traction. They're probably doing this fully prepared to get doxxed themselves.
Phone number, family members' full names, movement patterns (location data), LINE account, Yahoo account, face photo, driver's license, My Number card (Japan's national ID)… that's just from a quick glance at the reposted images.
Realistically, they had no choice but to prepare to pay the ransom while patching the security hole in parallel. Instead they went all-in on resolving it without paying — and promptly got wrecked for it.
They're probably operating out of some country where the police look the other way as long as you bribe a politician.
Those "yami baito" burglary rings (shady under-the-table gig-work crime gangs) start exactly from personal info like this. If it's all out there, it wouldn't be surprising if it gets abused.
What's the basis for thinking the hackers would actually stop if you paid the ransom anyway? What incentive would they even have to stop?
Exactly. A lot of online credit card payments route through GMO's services.
The hacker scene actually tends to honor deals like that fairly often. More importantly, if they keep leaking info like this for two years straight, the company is genuinely finished. This isn't on the level of just credit card info.
So again — what's that actually based on? The hackers already have the stolen data in hand; they can keep threatening the company indefinitely regardless of what's paid.
https://imgur.com/Amn0f5g.jpg
GMO will probably get off the hook and get bailed out with public funds. Meanwhile the users will be targeted by this criminal organization for life.
Because this was preventable damage. GMO's the one at fault.
It's like a building manager leaving the master key lying around somewhere and then freaking out when it gets stolen. Sure, the thief's to blame, but the manager's carelessness deserves blame too.
There's no way the people who skimped on building maintenance fees — no locks installed, security cameras switched off, guards laid off — bear zero responsibility.
Background and Key Points of This Story
In recent years, “double extortion” — where ransomware groups steal data, demand a ransom, and then publish part of it if refused — has become a common tactic. In principle, cloud service data is supposed to be wiped immediately after cancellation, but in actual operation, retention periods sometimes get extended for reasons like cost-cutting, which experts have flagged as a risk that can itself cause secondary harm. It’s worth noting that the explanation circulating in the thread — that “the canceled server was left running until the next customer signed up” — is not an official statement from GMO but speculation from 5ch users, and has not been verified. Additionally, damages awarded for personal data leaks in Japan tend to be lower than in the US; the thread speculated around 500,000 yen, but the actual amount would depend on the type of data leaked and whether concrete harm occurred. As for where responsibility lies, the hackers’ criminal conduct and GMO’s inadequate management are separate issues — this isn’t a simple case where clearing one side automatically settles the other.
*This article is excerpted and summarized from the 5ch (Nandemo Jikkyo G) thread “[Great News] GMO Is Going For a Dramatic Comeback Victory, lol.”
Leave a Reply