Hackers attacked GMO Internet Group and demanded $50 million in ransom, but the Japanese corporation refused and offered a reward to anyone who found the culprit.

"The cyberspace that my colleagues and I have built, with the belief that it will bring smiles to everyone, is now at risk of being completely destroyed by bad actors," GMO CEO Masatoshi Kumagai wrote on his blog on October 25.

GMO Internet Group was founded in 1991 in Tokyo, currently has 8,000 employees and operates in the fields of Internet infrastructure, network security, advertising, online finance and new technologies. The group has 9 member companies listed on the stock exchange.

Earlier this week, GMO's cybersecurity department announced it had suffered a wave of cyber attacks from outside. Mr. Kumagai said the attack could affect 26,739 servers.

Taking advantage of AI to attack

"The core problem is the explosive development and abuse of AI," said GMO CEO. "The ability to combine and disseminate open source AI models to create a wide range of attack tools is lowering the technical barrier, making activities that once required highly specialized expertise accessible to anyone."

According to Kumagai, the incident targeted about 20 Japanese companies using the company's services, through an automated artificial intelligence penetration testing tool called Artex, which was originally designed for defense purposes but was abused.

It all started on October 19, when the company investigated customer complaints and discovered a malicious program on some servers. At 4:00 a.m. on October 21, these systems were stopped working one by one to limit damage.

The company later confirmed that 26,739 servers were potentially affected, but were only "at risk" and did not lose data or sensitive information. On October 24, GMO confirmed that the system had security problems.

TBS News Dig recorded a case of a 44-year-old investor losing more than 4 million yen (25,000 USD), and another case of losing more than 2 million yen (12,500 USD). Meanwhile, Kumagai admitted that the environment connected to the financial infrastructure of more than 70 domestic and foreign companies was targeted.

According to WSJ, on October 27, Japanese Finance Minister Satsuki Katayama said that five foreign exchange (FX) trading companies recorded customer losses in allegedly related cases, including Goldenway Japan, OANDA Securities, Ava Trade Japan, Gaitame Finest and Dukascopy Japan. Businesses have applied measures to restrict transactions, block suspicious orders and request password resets.

Confrontation between the two sides

On October 21, hackers demanded $50 million for the data they held. In a forum post on October 27, the group announced the release of information about each customer, threatened to reveal user data from more than 26,000 servers until GMO agreed to compensate, and requested to transfer one million USD before 12:00 a.m.

"We have set a deadline of 12:00 on October 27, but GMO does not participate in any negotiations. Therefore, the information will be made public one by one," the hacker group said.

The hacker said so much personal information was collected that "it would take several years" to reveal it all. Everything will "stop" if a ransom is received.

According to Japan Times, instead of compromising, GMO immediately required users of the company's services to run a comprehensive virus scan on their computers, back up data and "unplug" their computers before the deadline stated by the hacker group. Throughout the day, the company continuously updated its website with new information and responses.

Currently, GMO records no ransomware attacks as threatened. The company also analyzed the computers of some banks to come up with countermeasures, and pledged to compensate victims for damages in addition to the general support of 5,000 Yen (32 USD) for all users.

Kumagai continued to call for support from all parties, saying not to take the situation lightly as "someone else's problem" or "a business's own trouble". "Now is the time to protect Japan, and the Internet, through public-private cooperation," GMO CEO wrote. "The Internet itself is at risk of collapse."

According to Kumagai, in addition to the company's 200 cybersecurity experts, cybersecurity and artificial intelligence units, including Trend Micro or a group of former members of the International Criminal Police Organization (ICPO), currently support GMO in fighting attackers.

“We are leveraging modern AI analytics environments, quickly sorting through large amounts of threat information and identifying fingerprints,” he said.

On the blog, Kumagai still updates the processing progress. On October 28, the company announced the removal of a number of extortion websites, as well as measures to collect and prevent the spread of information. A day later, he said he had the first clue.

"We have obtained valuable information to help identify the culprit," GMO CEO announced on October 29. "Information will be given to police and relevant parties today."

Meanwhile, the hacker group behind the attack has not made any new moves.

Michael Rogers, former commander of the US Cyber ​​Command and former director of the US National Security Agency, assessed that Japan reacted slowly. "Intrusions are only known when the network owner discovers it, which is too late," he commented at a cybersecurity event at Keio University. "This reflects that we do not really understand the extent and importance of the problem."

Bao Lam summary