“Lost 20 million won in just 84 seconds”: Japanese company hit by hackers sends SOS to government

【Financial News Tokyo—Special Correspondent Seo Hyejin】GMO Internet, a Japanese internet company, has urgently asked the government to stop a hacker attack involving the unauthorized manipulation of customer accounts. The company called for a national-level response as customer losses mounted, including one victim who lost about 20 million won in investment funds in just 84 seconds. The Japanese government has taken a cautious stance, saying the system is not activated at the request of individual companies.
According to the Yomiuri Shimbun and the Asahi Shimbun on the 25th, GMO announced on the 24th that it would compensate victims of a hack targeting its server-rental service for automated FX (foreign exchange margin) trading. It also disclosed that it had asked the government the previous day to activate “active cyber defense.” The measure involves police and the Self-Defense Forces infiltrating servers used in an attack to disable or delete malicious programs. The relevant law fully came into force in Japan on the 1st of this month.

Victims lost investment funds through repeated trades without their knowledge. A male office worker in his 60s from Hiroshima Prefecture discovered on the morning of the 22nd that his FX account balance had fallen from 4 million yen to about 1.6 million yen. Trades in which currencies of countries he had never traded in were bought and then immediately sold were repeated 48 times. He lost about 2.4 million yen (about 20.33 million won) in just 84 seconds.
A 37-year-old female office worker living in Osaka also lost 1.19 million yen (about 10.08 million won) in a single transaction early that same day, selling the South African rand and buying euros. Her losses grew to 1.78 million yen after including automatic liquidation and other losses. “I felt reassured because it was a well-known major company,” she said.
The hacked “Onamae.com Desktop Cloud” is not a service that directly brokers FX trades. It rents out virtual private servers (VPSs) so individual investors can automate trades through accounts they have opened with securities firms and FX companies. Customers install trading programs on the servers, allowing them to continue trading 24 hours a day even when their own computers are turned off. The service was launched in 2010 and has more than 20,000 users.
The attackers are believed to have infiltrated the servers and stolen authentication information, including stored trading account IDs and passwords. They may have used it to manipulate without authorization accounts customers had opened with separate financial firms. GMO said unauthorized trades may have been made in customer accounts at more than 70 securities firms, FX companies and other businesses in Japan and abroad.
Tasuku Kashimura, a senior researcher at the Dai-ichi Life Asset Management Economic Research Institute, said automated trading “operates with accounts logged in even when users aren’t watching,” adding, “Couldn’t the attackers have exploited the fact that it is difficult to notice anything wrong even if criminals take control?”
GMO said there have been no confirmed cases so far of customer funds being transferred to other accounts or withdrawn. Analysts say the hackers’ method appears to be to increase customer losses through unauthorized trades and then demand money from the company.
There have also been cases of threatening emails sent directly to customers. A 32-year-old male office worker from Saitama Prefecture, who lost about 550,000 yen through unauthorized trades, received an email early on the 24th saying, “We will release customer data.” The sender, claiming to be part of a hacking group, also attached some material they claimed to have obtained illegally.
The man reportedly set up a “passkey,” which uses fingerprints, facial recognition or other methods for authentication, to guard against the leakage of personal information. “Now that the damage has reached my personal assets, it feels like things have finally come to this,” he said. “There’s a limit to what individuals can do to protect themselves.”
Mika Fukuda of the security firm Mitsui Bussan Secure Directions noted, “It is extremely unusual for perpetrators to inflict losses on customers, send a statement about their crime, stoke anxiety and pressure a company.”

After receiving inquiries from customers, GMO began investigating on the 19th. It found malicious programs on some servers the next day, the 20th, and halted server operations starting at 4 a.m. on the 21st. However, the risk of hackers using stolen authentication information to access accounts at financial firms has not gone away. The hackers threatened to continue unauthorized trades and release company and customer information unless they were paid.
GMO rejected the demand, saying there was no guarantee that paying the hackers would make them delete the information or stop abusing it. The company has asked the government to block the attack while cooperating with the police investigation.
The government says it must separately assess whether the criteria for a national-level response are met. A government official told the Yomiuri Shimbun, “This is not a system in which activation is decided in response to an individual company’s request.” The official told the Asahi Shimbun that it applies to “cases with a significant impact, such as those involving operators of critical infrastructure.”
Under active cyber defense, measures to neutralize an attack are carried out by police officers with specialized expertise to prevent serious harm to people’s lives, physical safety or property. When highly organized and planned attacks are carried out from overseas, the Self-Defense Forces respond jointly with the police. In principle, prior approval from the independent Cyber Communications and Information Oversight Commission is required. When overseas servers are targeted, the Foreign Minister must also be consulted in advance.
An official at the Prime Minister’s Office said, “A more detailed analysis is needed to determine whether to apply active cyber defense.” The government says it will generally not disclose whether measures were taken in individual cases, even if it does take action, because doing so could expose its methods.
GMO will compensate customers for losses and fees incurred through unauthorized trades and will separately pay all users 5,000 yen (about 42,350 won) in consolation money. Those who wish to do so will be offered a replacement service free of charge for six months. Instructions on how to apply for compensation will be provided by November 6.
However, calculating the total losses may take time, as GMO must obtain records from securities firms and FX companies to verify the actual trades. The hacking group claimed it had caused losses of several billion yen, but that amount has not been confirmed.
[email protected] Seo Hyejin Reporter