GMO Internet hit by breach exposing thousands of servers and triggering unauthorized trades

Sources · 5 sources

1. BT

   Bull Theory@BullTheoryioPost on X · 18h ago

   🚨 Hackers just hijacked trades at 70 brokerages Japan's GMO Internet Group has confirmed a major cyberattack on Onamae Desktop Cloud, a service many forex traders use to run automated trading software around the clock. Up to 26,739 servers may have been exposed. The attackers stole traders' login details and used them to place unauthorized trades across more than 70 brokerages. In one case, an account lost around 2.4 million yen in about 84 seconds. The hackers then demanded a $50 million ransom in crypto. GMO refused to pay and has reported the attack to the police. GMO began shutting down the affected servers on October 21. Every user will receive 5,000 yen, along with full compensation for verified trading losses. GMO shares fell almost 16% on Monday to a four month low. CEO Masatoshi Kumagai warned that the internet itself is starting to break down. Prime Minister Sanae Takaichi held an emergency cybersecurity meeting on October 26. This adds to a brutal month for cybersecurity. Japan has already recorded 723 cyber incidents this year, and State Bank of India customer records surfaced on the dark web just last week.

   Open source
2. NA

   Nikkei Asia@NikkeiAsiaPost on X · 2d ago

   Japan net provider GMO seeks 'active cyber defense' from government https://t.co/xSoDnxQUiR

   Open source
3. AC

   Andrew Curran@AndrewCurran_Post on X · 1d ago

   A cloud VPS service from Japan's massive GMO Internet Group used by foreign-exchange traders has been hacked. Attackers breached the servers, stole customer credentials, and executed balance-destroying trades across over 70 brokerages. GMO has asked government agencies for help. https://t.co/AgL1S0QfJF

   Open source
4. MT

   MTS@MTSlivePost on X · 14h ago

   Situation of the Week 10/19-10/25: Black October Though real-world impacts have lagged behind, AI has been cyber-capable for quite some time now. Anthropic finished training Claude Mythos Preview in February. It was substantially better than previous models at cyber tasks, so instead of releasing it right away, Anthropic and industry partners secretly launched Project Glasswing to find and fix vulnerabilities in open-source software so they couldn’t be exploited. Anthropic announced Mythos and Glasswing in April, but didn’t release a Mythos-class model to the public until Fable in June, when they had built strong enough safeguards to block the model from doing cyber tasks. Other labs soon caught up. In May, OpenAI launched Daybreak, their own version of Project Glasswing, and in July, they caught up to the cyber frontier with GPT-5.6 Sol. Chinese labs kept pace a few months behind, with https://t.co/90zyG2rPa4’s GLM-5.2 in June, then Moonshot AI’s Kimi K3 in July, and finally https://t.co/90zyG2rPa4’s GLM-5.3 in August, which was about as cyber-capable as early Mythos. Yet despite the Cyber ECI climbing steadily month after month, and despite warnings from cyber experts growing louder and louder, there was no increase whatsoever in cyberattacks on American citizens between June and September. Then, all of a sudden, the last week saw a flood of disclosed vulnerabilities in various important pieces of software. A quick timeline: Monday: A Chinese hacker used just $5k of tokens to break into over 100 websites, including ones owned by major companies like Deere, SharkNinja, and Cummins, using the penetration-testing agent harness Cairn. Anthropic announces OSS Scanner, a free service scanning open-source code repositories for vulnerabilities. Tuesday: Vals AI finds that the open-weight DeepSeek-V4.1-Flash-1017 (released on October 17), beats the cyber-enabled version of GPT-6 Sol (released less than a month earlier, on September 22), on their offensive cybersecurity evaluation. Fortinet, a major cybersecurity company, announces that they will release a set of security updates across their products to help defend against agentic cyberattacks. Wednesday: Two critical vulnerabilities in PHP, a scripting language powering the majority of sites on the Internet, are patched with the help of OpenAI’s Patch the Planet program. The NSA urges all organizations using PHP to update immediately, or take their systems offline until the vulnerability can be mitigated. GitLab, a software development platform with over 50 million users, releases a critical patch to fix a vulnerability that allowed for remote code execution. Node.js releases a critical patch for their own remote code execution bug. Railway, a platform for deploying software in the cloud, discloses a major breach where attackers were able to access ~100k customer environment variables, and urges users to rotate their API keys. LiteLLM, an LLM gateway, discloses their own breach. Jason D. Clinton, Deputy Chief Information Security Officer of Anthropic, says “things are going to get a lot worse before they get better.” Thursday: Axios reports on banks seeing a major increase in unauthorized agent activity in user accounts, though most of this is users’ personal agents acting on their behalf. Abliteration¹, a startup that sells access to open-weight models with cyber guardrails removed, releases abliterated-model-large-flash, an abliterated version of DeepSeek-V4.1-Flash-1017. Quest Diagnostics, a healthcare company serving tens of millions of Americans, announces it was breached and sensitive patient information was stolen. Sam Altman says “I no longer think we’re going to be able to just patch all the bugs. We’ll have to use the same AI technology to build a new kind of defense shield.” Matthew Prince, CEO of internet infrastructure company Cloudflare, says he is aware of “a bunch of additional severe vulnerabilities that are present in other pieces of critical software” and says “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling.” Moonshot AI releases Kimi K3.1 Pro, which outperforms all publicly available models on cyber tasks, even despite Moonshot saying it will not push the absolute cyber frontier. X users take to calling the recent slate of cyber incidents “Black October.” Friday: OpenAI reveals that the vulnerability in Node.js came from Brotli, a compression library used in a lot of software, including the JavaScript runtime environment Bun (now owned by Anthropic and a critical part of Claude Code). Saturday: GMO Internet Group, Japan’s largest internet infrastructure company, experiences a major cyberattack where some users’ financial accounts were drained. They call for help from the government, and CEO Masatoshi Kumagai says that “the Internet itself is on the verge of collapse.” So, will there be major disruptions to the Internet or real life? Something like the French supermarket hacks from last week that shut down refrigeration systems and forced hundreds of markets to throw out food, but at a much larger scale? It’s not clear. On the one hand, the trend lines are clear. AI is getting increasingly powerful and its capabilities are getting increasingly diffuse, and attack surfaces are just so vast. Defenders have to patch all the vulnerabilities, while attackers only have to exploit one of them. “Security by obscurity” is now completely inadequate, as agent swarms can scan for vulnerabilities more tirelessly than any human. On the other hand, most of the cyber incidents reported (so far) are disclosures of vulnerabilities that have already been patched. Markets don’t seem to be reacting much. SPY fell 0.95% over the past week. CIBR, the First Trust NASDAQ Cybersecurity ETF, rose 5.91%. VIX, a measure of volatility, rose 5.82%, a negligible spike compared to major world events from the last few years like COVID, Trump’s Liberation Day tariffs, or the Iran War. And defenders are much better-resourced than attackers. So maybe agentic botnets will overwhelm the cyber infrastructure that we take for granted, forcing much of the internet offline as defenders scramble to take them down, and impacting people’s lives like COVID. Or maybe society’s ability to respond will be strong enough to address these problems before they manifest fully, and it’ll be another Y2K. In either case, you can make yourself a more difficult target. Turn on automatic updates for your phone, computer, browser, and apps. Don’t click on suspicious links or emails. Never reuse passwords, and store them securely in a password manager like 1Password. Use two-factor authentication with your accounts, and use an authenticator app like Duo Mobile rather than your phone number. Add a port-out pin with your mobile carrier so they won’t transfer your phone number to an attacker’s SIM card. Set up a family safe word or phrase to avoid voice scams over the phone, and turn off voice authentication at your bank or mobile carrier. If you really want to be secure, use a Yubikey, a physical hardware authentication device, instead of a password. One worrying sign for the future: If this is how AI makes impacts in the real world — first by silently climbing benchmarks while the real world stays exactly the same, then by crossing some critical threshold that causes real-world impacts to go vertical — it really doesn’t bode well for society’s ability to respond to much larger future problems like biorisk, unemployment, or loss of control. Written by @theojaffee

   Open source
5. BL

   Bloomberg@businessPost on X · 2d ago

   Japanese IT services provider GMO Internet Group said it has asked the government to deploy active cyber defense as it works to contain the fallout from a hacking incident. https://t.co/GMV4uXxoaN

   Open source
6. MT

   MTS@MTSlivePost on X · 1d ago

   SITUATION DETECTED: Following the massive cyberattack on Japan's GMO Internet Group, which led to fraudulent trades across 70+ brokerages and FX platforms, CEO Masatoshi Kumagai warns that the internet itself is on the verge of collapse.

   Open source