GMO Onamae Desktop Cloud breach: 26,739 servers, saved logins

Japanese internet giant GMO Internet shut down its Onamae Desktop Cloud service after an intruder planted malware on customer servers and used saved trading logins to make unauthorized trades. GMO says 26,739 servers may be affected. On October 27 the attackers posted what they claim is customer data, after demanding about 8 billion yen. The lesson from the GMO breach is not about Japan or forex. It is about any hosted box where your team saves passwords "for convenience."

What actually happened

The timeline below comes from GMO's own second report and tenth report, plus TechCrunch:

• The service. Onamae Desktop Cloud rents hosted virtual desktops. Customers use them to run trading tools such as MT4 and MT5 around the clock.
• Oct 19–20. A customer inquiry led GMO to confirm "a malicious program had been installed by a third party" in some customers' server environments. New sign-ups and the control panel were suspended.
• Oct 21. GMO began suspending servers on every plan. Customers then reported unauthorized operations on their trading accounts. GMO says the intruder got trading logins and other data stored on the servers. It says card data is not stored there.
• Extortion. GMO received an email on October 21 demanding about 8 billion yen (about $50 million, per TechCrunch). It says it will not pay.
• Oct 27. The suspected attackers published material they say covers GMO and its customers. GMO is still verifying it and says no ransomware had been confirmed as of 13:55 JST.

GMO has not said how the attacker got in. An outside security firm is investigating, and police are involved. There is no date to restore the service.

Why the GMO breach matters for your business

Small businesses run on hosted desktops more than they admit. QuickBooks hosting. A remote Windows box for the one legacy app. A VPS where the bookkeeper logs into the bank. And on every one of those, somebody clicked "remember my password."

That is exactly what was taken here. The attacker did not need to break the trading platforms. The logins were sitting in the tools on the server. When the host is compromised, every credential saved on it belongs to someone else.

What we tell clients:

1. Do not save credentials on a machine you do not control. Use a password manager that fills on demand, not a saved login in the app.
2. Turn on MFA for every account reachable from that box. GMO's own advice includes it. A stolen password without the second factor is a much smaller problem.
3. Change passwords from a different device. GMO says this too. If the server is compromised, typing the new password into it hands that over as well.
4. Know your exit. If your host goes dark for a week, what stops? Write that down before it happens.

Sources: GMO Internet second report, GMO Internet tenth report, TechCrunch.