The threat site operated by the hacker group demanding a ransom in the unauthorised access incident targeting GMO Internet Group has been taken offline. The Metropolitan Police Department has launched an investigation on suspicion of violations including the unauthorised computer access law, and GMO has established a reward fund to help identify the group behind the attack.
In a cyberattack targeting GMO Internet Group's virtual private servers for automated FX trading, the group behind the attack threatened to publish victims' information and demanded cryptoassets worth approximately ¥8 billion. The demand was later reduced to approximately ¥160 million.
The leak site and mirror site operated by the group are believed to have been taken offline by a US provider, which deemed the unauthorised publication and extortion activities inappropriate and suspended the domain for violating its terms of service. They became inaccessible at around 4:00 a.m. on 28 October.
GMO officially announced that the site had been taken offline and stated that it would immediately take steps to shut down any similar sites if they are established in the future. No new public site has been confirmed as of now, but the investigation is ongoing.
GMO representative Kumagai Masatoshi (熊谷 正寿) stated that the company was considering legal action against anyone attempting to disseminate personal information. The Metropolitan Police Department launched a full-scale investigation on suspicion of violations of the unauthorised computer access law and other offences, and is proceeding with efforts to assess the damage.
Details of the attackers' entry route and whether any other information was leaked remain under investigation, and the response involves coordination between investigative authorities and businesses.
GMO is strengthening its countermeasures, including establishing a reward fund totalling approximately ¥150 million and calling for information.