Trading Platform Rocked by Japan Hack, $50 Million Ransom

Hackers targeting a currency trading platform claimed to have published customer information after failing to receive a $50 million ransom, adding to a wave of cyberattacks in Japan that have prompted the government to draw up emergency measures.

GMO Internet Group Inc., the subject of the latest attack, asked customers to scan their PCs for viruses, back up their files and unplug and turn off their devices, saying it would not agree to the hackers’ demands. The company hasn’t confirmed a follow-up ransomware attack, which the hackers had also threatened. Some clients had earlier flagged transactions they hadn’t initiated.

Related: Japan Takaichi Orders Cybersecurity Measures as Attacks Grow

A GMO spokesperson said its trading service had been suspended since Oct. 21, with the company also pausing new subscriptions. Every user of Onamae.com could be affected after all the cloud service’s servers were compromised, they added.

On Monday, GMO’s shares tumbled the most since 2011 as concerns over the impact of a cyberattack deepened. GMO asked the government over the weekend to deploy active cyber defense after its services were subjected to unauthorized access.

With dozens of businesses in Japan reporting breaches to their systems and potential leaks of client data in recent weeks, Finance Minister Satsuki Katayama said the nation would address the damage from the latest attack with a sense of urgency.

Katayama said there was “a sense of crisis shared globally” over cybersecurity as hackers harness artificial intelligence to take advantage of vulnerabilities. “Given how rapidly these incidents and circumstances evolve, we will continue to call on financial authorities to respond appropriately and swiftly as developments unfold,” she told reporters.

The finance minister said earlier that five foreign exchange firms had reported customers affected by the GMO incident. She added that she had received no reports of new unauthorized transactions. GMO sought government assistance on Saturday to help disrupt the source of the attacks. Hackers claim to have published personal information on one GMO customer, NHK reported without attribution.

Emergency Measures

Prime Minister Sanae Takaichi instructed her cabinet on Monday to draw up emergency measures by the end of next week in response to the spate of cyberattacks.

Marito Ueda, president of SBI FX Trade, said the retail currency trading industry as a whole has recently been seeing customers closing dormant accounts, and that with interest rates rising, he expected some people to opt to put money back into bank deposits.

“Yet, those who were actively trading FX appear to have stayed in the market, as trading volumes have not declined,” he said. “If the fallout extends beyond FX and into equities for instance, it could become much harder to contain.”

At a regular press conference on Tuesday, economy minister Ryosei Akazawa said the government would offer smaller companies free consultation services on boosting their cybersecurity.

Cyberattacks and the discovery of vulnerabilities in PHP programming language used in some websites have made a swift response an urgent priority for businesses and the government. Several political parties called for stronger measures last week.

In recommendations submitted to Takaichi last week, the ruling Liberal Democratic Party said the recent wave of cyberattacks constituted a serious crisis that could be described as “the eve of a cyber emergency,” threatening Japan’s national security. It warned that “AI cyber saturation attacks,” in which the technology automatically identifies system vulnerabilities and launches attacks simultaneously, could occur in the near future.

The party also proposed creating a response headquarters led by the prime minister’s office, while accelerating efforts to improve the capabilities of the Self-Defense Forces and police and strengthen cooperation with allies. In the financial sector, it called for the public and private sectors to work together to steadily implement defensive measures.

‘AI Versus Humans’

Masaaki Taira, a former digital minister who led the drafting of the recommendations, said attackers are using AI to mount hacks faster and on a broader scale than before, while companies are still relying on people to defend themselves. “Structurally, it has become AI versus humans,” he said. The government needs to work with leading AI companies to build a system capable of using AI for defense, he added.

“The recent surge in AI-enabled breaches of Japanese web-based systems has already led to the thefts of 187 million people’s personal information in total,” said Mihoko Matsubara, chief cybersecurity strategist at NTT Inc. “Global cyber defenders including Japan are struggling to keep up with the speed and scale of AI-enabled cyberattacks.”

One common concern is securing specialist personnel. With highly skilled private-sector cybersecurity professionals such as white-hat hackers in mind, the LDP called for the creation of a new personnel and compensation system that would “break through the rigidities of the civil-service system and enable compensation commensurate with market value.”

Behind these proposals is a recognition that government salaries are insufficient compared with those in the private sector. According to the National Personnel Authority, the government can offer annual compensation of as much as ¥33.8 million ($214,000) under its fixed-term appointment system to private-sector personnel with specialized expertise.

Top photo: Satsuki Katayama Photographer: Kiyoshi Ota/Bloomberg.