Key takeaways

  • Extortion runs on attention. The attackers who hit GMO Internet's Onamae.com Desktop Cloud set deadlines, published data, threatened customers' PCs and, according to Kyodo, prepared a fake "victims' forum" before GMO had even disclosed the breach. Every headline added to the pressure.
  • GMO answered with a public campaign of its own: a request to the government for the "first activation" of active cyber defense, a CEO blog revealing the US$50 million demand, a US$1 million bounty with tip counts published every weekday, public tallies of warnings sent to posts on X, and the CEO's personal social media.
  • Its customer advice was good, and so was its refusal to pay and its clear compensation. Those were buried under the spectacle.
  • In our view, whatever the intent, GMO turned an extortion into a public fight and kept it in the headlines for two weeks, which is the worst way to respond to people who need attention. The first press conference, on November 2, continued the pattern: an emotional speech and a talk on AI that the CEO himself said was a separate issue, where customers wanted an account of what went wrong.
  • For practitioners: one channel, facts and customer actions on a fixed rhythm, cooperation with authorities stated rather than narrated, and the executive's personal accounts kept out of it.

What extortion needs#

An extortion like this one works by raising the cost of saying no. The attackers who broke into GMO's trading VPS service traded in customers' broker accounts with stolen logins, demanded money from GMO, set a noon deadline to publish customer data and threatened a ransomware attack on customers' own PCs. When GMO refused, they began publishing data.

All of that pressure depends on people paying attention: customers who panic, journalists who cover each threat, social media users who share the site. On November 1, Kyodo News reported another tool aimed at the same thing. A site calling itself an information sharing forum for victims had been built in the same way as the attackers' own site, and was being prepared before GMO disclosed the breach on October 21. An extortion crew that builds a gathering place for angry victims in advance is planning to use public attention as a weapon.

The best response to that, in our view, is the dullest one that still protects customers: tell them exactly what to do, keep official updates factual and regular, say you will not pay, work with the police, and give the attackers nothing new to react to.

What GMO did well#

GMO deserves credit for several things, and they should not be lost in the criticism:

  • Clear instructions to customers. It told them to have every broker session cut, to change passwords from a device they do not use for trading, to back up and power off their PCs before the attackers' deadline, and not to visit or share the attackers' site. That is specific, practical advice of a kind many Japanese breach notices lack.
  • Refusing to pay, said early and without hedging.
  • Clear compensation. ¥5,000 for every user, realized trading losses covered, and set amounts for each category of data the attackers publish, as we described in our article on breach payments.
  • Frequent official updates. A crisis communication specialist writing in ITmedia on October 29 praised GMO for publishing what it had confirmed as it went, rather than waiting for the full picture. We agree with that part.

Where it became a public fight#

Around those official notices, GMO and its CEO built something else. In order:

Date What GMO did
Oct 24 In its fourth report, asked the government for the "first activation" of active cyber defense, which, as we explained at the time, the law does not offer a company
Oct 25-26 CEO Masatoshi Kumagai's blog: the case for that request, and the US$50 million demand made public
Oct 27 Five numbered reports in one day; a US$1 million bounty, open "until the culprits are arrested"
Oct 28 A dedicated bounty site; 113 tips in six hours announced the same evening, with a count of 20 warnings sent to posts on X, and a promise to keep publishing updates until the culprits are arrested or internationally wanted
Oct 29 onward Tip counts published every weekday at 18:00; Kumagai apologizes on X for his own posts
Nov 2 First press conference: apologies, a talk by the CEO on AI and his 31 years in the industry, and executive pay cuts announced the same day

Each step had a reason that can be defended on its own. Bounties exist, and companies do cooperate with governments. Taken together, they turned GMO's response into a running story with a hero, a villain and a daily scoreboard. The attackers could not have asked for more coverage.

The CEO's own accounts made it worse. At the press conference, Kumagai apologized for posts made during the incident: posts touching on the victims, a photo of himself smiling, and a comment to a user who had posted about the group's track team. He said all of them lacked consideration for the people affected. When the head of a company under extortion posts in a personal voice, every post becomes part of the incident, for customers, reporters and the attackers alike.

The government request was the wrong thing to announce. The ITmedia writer made a point we share: asking the government for help and publicizing that request are separate decisions, and matters close to investigations and national security are usually best handled quietly. By announcing it, GMO made the government's response a news story and invited everyone, the attackers included, to watch for it.

The press conference was part of the show. The questions customers and practitioners had were concrete: how the attackers got in, why a 2024 finding by GMO's own security subsidiary was not acted on, and what happened to customers' data and money. Some answers came: according to Kyodo, the first intrusion was on August 5 and went unnoticed until October 20, and the 2024 finding had been closed with a temporary fix. But GMO has published no presentation materials, and much of the event was about something else. According to ITmedia, the second part was a talk by Kumagai on how AI has sped up cyberattacks, which he then said in the question session was a separate issue from this breach. At times in tears, he spoke about his 31 years in the industry, said he had never once used the word "profit", and said he would stake his life on cleaning up the internet. Details are in our incident article.

Customers heard something else. The Asahi Shimbun asked users what they made of the conference. A man who lost about ¥6 million in trades he did not make said he wanted the compensation paid quickly and that apologies alone did not reach him. Another user asked why known problems had been left unfixed, and said the time to act was before the tears, not after. Users also called the executive pay cuts too light compared with what customers were going through. The conference was built around the company's story; the people affected were waiting for answers about their money.

Our view#

GMO answered spectacle with spectacle, and that was the worst response available. We do not know what GMO intended, and we do not suggest it was seeking publicity for its own sake. But the effect is what matters in an extortion. The attackers needed the case to stay loud: loud enough that customers would be frightened, that GMO would feel pressure, and that a fake victims' forum would find visitors. GMO's bounty scoreboard, its public appeal to the government and its CEO's posts kept it loud for two weeks. A company that refuses to pay takes away the attackers' money. A company that also stays calm takes away their audience.

The press conference was a performance, not an accounting. A press conference after a breach is where a company is supposed to answer for what happened. This one gave as much room to the CEO's feelings, his career and his views on AI as to the attack itself, and it came on the same day as pay cuts that customers called too light. Holding a conference is not the problem; turning it into one more stage is.

The real story was elsewhere. The most important facts in this case are about GMO itself: a weakness its own experts flagged in April 2024, a temporary fix, and an intruder who went unnoticed for about eleven weeks. A response built around the bounty, the government and AI drew attention away from those facts, whether or not that was the aim. The promised review of what happened before the incident is where GMO can still give other companies something useful.

None of this undoes the good advice. Customers who followed GMO's instructions were better protected for it. The lesson is not to say less to customers. It is to stop the communication around them from becoming a show.

What this means for practitioners#

  • One channel for the incident. Numbered notices on the company's site, with customer actions first. Keep executives' personal accounts out of it, or silent, until the incident is over.
  • A fixed rhythm, not a running commentary. Update when there is something customers need to know, on a predictable schedule. Avoid daily counts that measure your own activity, such as tips received or warnings sent, which make the incident a contest.
  • Say you are cooperating; do not narrate it. "We have reported this to the police and are working with the relevant authorities" is enough. What you have asked of the government, and what investigators are doing, is not for press releases.
  • Refuse to pay without a performance. Saying you will not pay is right. Publicizing the demand and dramatizing the refusal adds to the attackers' profile.
  • Think hard before a public bounty. If one is used, let investigators run it, and do not publish its running totals.
  • Warn early about fake victims' groups and recovery offers, as part of the customer advice.
  • Make the press conference an accounting, not a performance. Answer the hard questions first: how they got in, what you knew before, and what happened to customers' data and money. Publish the materials. Leave personal reflections and industry-wide speeches out of it.

Japanese terms at a glance#

Japanese Reading Meaning
記者会見 kisha kaiken Press conference
第◯報 dai ◯ hō Report number ◯, a numbered incident notice
懸賞金 kenshōkin Bounty, reward
能動的サイバー防御 nōdōteki saibā bōgyo Active cyber defense
身代金 minoshirokin Ransom
恐喝・脅迫 kyōkatsu / kyōhaku Extortion / threats
危機管理広報 kiki kanri kōhō Crisis communication
役員報酬の減額 yakuin hōshū no gengaku Executive pay cut