From our other sites
The story
A story blew up on 5ch after a hacker claimed they had reported vulnerabilities to GMO’s security contact point dozens of times over several months, only to be ignored. GMO Group operates widely across payment processing and internet-related services, putting it in a position where neglecting such reports could have real consequences for how customer data is handled. The thread split between users slamming the company’s inaction as sheer incompetence and others questioning the hacker’s motives and methods, while reactions also spread over executives who had posted selfies right after the scandal broke.
What people said
(though apparently he's now using customer data as leverage to demand money
If there was no reward on the table, why would he even bother reporting the vulnerability in the first place
The real problem is GMO being a bunch of cheap f**kers…
The person who reported the bug to GMO and the person making threats now are two different people
Only Yahoo Comments readers and the 'NanJ' board crowd (known for skimming without reading) could fail to parse something this simple
More like a 'white f**ker'
But that seems unlikely when they supposedly have 200 people on staff
tps://i.imgur.com/UbDeqpF.jpeg
tps://i.imgur.com/AuvC9dj.jpeg
tps://i.imgur.com/ZprzGUm.jpeg
tps://i.imgur.com/aT2DhHP.jpeg
Whether management actually acts on a report is a whole separate issue — every time
No different from some fake engineer who's really just a crappy YouTuber
These guys are all staring at the same kind of weird-looking screen
Is that actually meaningful, or just for show?
No matter how this turns out, I'm never using GMO again
Well, a hacker's word carries more weight than an idiot's
And they really did get hacked and are freaking out, so…
https://x.com/m_kumagai/status/2115085981695222149?a=_B81VGJAzCgEr0NoVoM&s=19
What's he even laughing about
Protecting what, from what, exactly?
you'd go straight for some celebrity's personal info first, right?
This hacker clearly doesn't understand Japan — must be a foreigner
Even without understanding Japan, you'd still dig up stuff on celebrities and politicians
Though maybe it's the opposite — he avoided them precisely because he does understand
They probably don't spend money on security
They probably just dump it on the police and the Self-Defense Forces and run
Because handing it off to the government costs nothing
By the way, a former senior Self-Defense Forces official parachuted into a cushy post there
I bet they're behind the strategy for how this whole thing's being handled
Background and key points of this story
‘Responsible disclosure’ — where someone who finds a vulnerability reports it directly to a company — is often backed by formal bug bounty programs at major overseas tech firms. When a report gets delayed or ignored, it’s not uncommon for the reporter to go public or, as in this case, for things to escalate into a full-blown controversy. Within the thread, some replies pointed out that the person who originally reported the vulnerability to GMO and the person now allegedly demanding money using customer data are two different individuals, though several posts conflated the two. It’s worth noting that everything shared here comes from one-sided accounts by anonymous posters, and as of this thread, GMO has not issued any official statement or confirmed the facts.
※This article is excerpted and summarized from the 5ch (Nandemo Jikkyō G) thread「[Sad News] GMO Hacker: ‘I Reported to GMO’s Vulnerability Contact Dozens of Times Over Several Months, But Was Ignored’」.
Leave a Reply