North Korea-linked hackers hit GMO in data breach — SkimNews
Get the Geopolitics newsletter
Daily geopolitics — wars, elections, sanctions, the diplomatic moves that move markets. Free.
- GMO Internet Group confirmed a cyberattack in October that led to unauthorized leaks of customer data from its foreign exchange trading service, which was later used in fraudulent transactions.
- Kyodo News, working with security experts, identified five IP addresses tied to the attack that previously linked to a North Korean hacking group, strengthening attribution claims.
- The attacker used a website to claim responsibility and potentially gather victim information, with a second 'information sharing' site set up two days before the breach was public, showing nearly identical code and design.
- Analysis of the attack site revealed file creation times in a U.S. time zone, an English OS, and software developed in China, suggesting an attempt to mislead investigators through a false flag operation.
- GMO GlobalSign K.K., a subsidiary of GMO Internet, disclosed that personal data of at least 45,000 people across client companies was leaked via its employee ID management service.
Why it matters: The attack compromised sensitive financial and personal data across thousands of individuals, with the use of sophisticated deception tactics indicating a high-level threat. The overlap in infrastructure and timing between the fake victim forum and the hacker’s site suggests a coordinated effort to exploit victims further, raising stakes for corporate cybersecurity response.
Ask SkimNews
