Tokyo, Nov. 2 (Jiji Press)–Masatoshi Kumagai, chairman and group CEO of GMO Internet Group Inc., which has been mired in an unauthorized access incident involving its servers, said Monday that the company had failed to address security flaws flagged two years ago. At the first press conference held by GMO since it announced the unauthorized access last month, Kumagai said, “We’d like to apologize from the bottom of our hearts to customers and related parties who suffered damage.” The company announced cuts in executive compensation the same day, including a 30 pct reduction in Kumagai’s pay for three months. At the press conference in Tokyo, the GMO group said that it was informed of system-related issues by experts from subsidiary GMO Cybersecurity by Ierae Inc. in April 2024. Kumagai acknowledged that the parent firm had failed to take sufficient measures after the warning, and said, “As the group’s top representative, I take seriously our failure to make use of this feedback.” GMO said its measures were inadequate because it prioritized stable service operations and lacked the analysis needed to determine which security response should be prioritized across the group. The issue was not reported to Kumagai, and the cyberattack could not be prevented although the group carried out four emergency maintenance operations, it said. The group also revealed that the unauthorized access to servers used for foreign exchange margin trading cloud services occurred Aug. 5 this year. The attackers accessed a management server Aug. 17 after fraudulently obtaining administrator privileges. GMO became aware of the unauthorized access on Oct. 20, after it launched an investigation in response to a customer inquiry. “We are truly sorry that we could not protect customers,” Kumagai said. “We must become a company that can quickly block (unauthorized) access and quickly recover (potential damage).” GMO announced on Oct. 21 that it had fallen victim to a cyberattack. Three days later, it asked the Japanese government to implement active cyber defense operations. On Oct. 26, GMO said that the alleged attackers had demanded 50 million dollars, or some 8 billion yen. Personal information believed to belong to a GMO Internet customer was revealed online the following day. The press conference lasted about three and a half hours. END [Copyright The Jiji Press, Ltd.]
