GMO Internet, one of Japan's largest internet companies, is fighting a serious breach of its cloud service. According to BleepingComputer, the company announced on October 21 that a third party had gained access to its Onamae.com Desktop Cloud service and installed malicious programs on users' servers. The potential impact: up to 26,739 servers. That is an upper bound, and the company has not said how many were actually found infected.
Traders hit
The service is popular with traders, who use the virtual servers to run automated trading software around the clock. In later updates GMO reported that customers complained of "unauthorized operations" in their trading accounts, and that third parties had probably seen their trading service passwords.
No ransom
The CEO said the company will not pay a ransom. GMO shut down the service on all plans with no date for resumption, and asked customers to change passwords from other devices. It will pay every customer ¥5,000, and compensate losses from unauthorized trades proven to have been caused by the breach. According to Nippon.com, the company also called on the Japanese government to take "active cyber defense" measures against the attackers.
The lesson
Cloud services that run real money, such as trading software, are a double target: attackers can both extort the company and exploit customer accounts. Investors who use remote servers for trading should make sure two-factor authentication is enabled on every account.
