GMO Says 26,739 Desktop Cloud Servers May Be Hit

GMO Internet has taken every plan of its Onamae.com Desktop Cloud service offline after finding that an outsider had planted a malicious program on customers’ servers. In a notice posted on 21 October, the Japanese company said 26,739 servers may be affected and that information stored on them may have been viewed.

TSN tracks attacks like this on its ransomware and cyber attacks hub.

According to GMO, it confirmed on 20 October that a third party had gained unauthorised access to the service and installed a malicious program in some customers’ server environments. To stop the damage spreading, it began shutting down customers’ servers in stages from 04:00 Japan time on 21 October (20:00 BST on 20 October). The shutdown covers all plans, and GMO says it will announce a restart date once one is settled. A separate maintenance notice shows the service had already been put into emergency maintenance from about 21:00 Japan time on 20 October, with servers unusable, new sign-ups suspended and the control panel locked. As of 19:41 Japan time on 21 October, it said, there was still no date for a restart.

No confirmed leak of the data GMO holds, so far

GMO is careful about what it knows. It says it has not, at this point, confirmed any leak of the customer personal information it holds, or any misuse of information that was viewed, and that it does not hold payment information, including card details. Its investigation of the servers is continuing, and it has not said how the attacker got in, what the program does, or how many customers the 26,739 servers belong to.

The risk it is warning about sits on the servers themselves. GMO is asking customers who keep or use login details, such as IDs and passwords, on their servers to change them promptly, and to change the same password anywhere else they use it. It also warns of phishing emails and suspicious contacts that piggyback on the incident, and says it never asks for passwords or card details by email or phone. GMO Internet’s corporate notice repeats the apology and points customers to the Onamae.com page for updates.

Forex traders are among those told to act

Desktop Cloud’s users include currency traders. OANDA Japan, a foreign-exchange broker, sent its own notice to clients on 22 October, describing the service as a virtual private server for running MetaTrader 4 and 5 and automated trading programs around the clock. Clients who ran OANDA’s MT4 or MT5 on Desktop Cloud may have had their OANDA login ID and password viewed by a third party, the broker said.

OANDA is telling them to change the password for its customer portal and for MT4 and MT5, to switch on two-step verification, to check their trading history and to contact its support desk if they find suspicious trades. The headline of its notice refers to unauthorised logins having occurred in connection with the breach, but the text gives no numbers or details, and the broker says it is still discussing how it will handle the matter.

That is the gap the next update from GMO will need to close. OANDA’s notice shows that some of those servers held brokerage logins, and until the company says what the malicious program did on those 26,739 machines, customers can only assume the worst and change everything.