A misconfiguration in GMO GlobalSign’s ID management service, “GMO Trust Login,” made customer information relating to 2,492 companies and 45,030 people externally accessible for approximately nine years. The issue was discovered in September following a report by an external researcher, and information retrieval by third parties has been confirmed since at least June 2021.
GMO GlobalSign disclosed that personal information of customers’ employees had been leaked through “GMO Trust Login,” its ID management service for employees. The incident affected a total of 2,492 companies and 45,030 people. Due to a configuration error, the information remained externally viewable and downloadable for approximately nine years, from November 2017 through September 2026.
The leak was discovered in September after an external security researcher reported the issue. The company determined that files containing personal information had been stored in publicly accessible storage. It confirmed that a third party had retrieved the information since at least June 2021, but could not determine whether any retrieval occurred before then because no records remained.
The company explained that it had been unable to identify the vulnerability over an extended period because its regular assessments covered applications and servers but not storage. A series of information leakage incidents across the GMO Group could affect market views of its governance framework.