GMO Internet, Inc. will pay current users of its breached Onamae.com Desktop Cloud service ¥5,000 each and cover verified unauthorized trading losses, putting compensation costs on the company.
The flat payment applies even to customers who lost no money. GMO has not disclosed how many customers were affected or what the payments and trading claims may cost in total.
A customer who receives a refund from a brokerage cannot collect the same amount again from GMO. A broker’s refusal to issue a refund, however, will not by itself rule out compensation. GMO said it will compare trading records with access logs and other evidence to determine whether the attack caused an unauthorized transaction.
The company’s policy covers losses already incurred on such trades, along with related fees and similar charges. It excludes losses attributed to market movements, missed profits and other indirect damages.
Onamae.com Desktop Cloud is a virtual private server service marketed for running automated foreign-exchange trading tools. GMO confirmed malicious software in some customer server environments on Oct. 20 and began shutting down servers across all plans at 3 p.m. EDT that day, or 4 a.m. JST on Oct. 21.
GMO said 26,739 servers could potentially have been affected. Its investigation also confirmed that customer information was taken outside the company, but it has not given a count of affected customers or specified the full set of data involved.
In a post dated Oct. 25 and updated Oct. 26, GMO Internet Group representative Masatoshi Kumagai said internal security specialists had flagged problems with the service before the attack. He said the response had fallen short in speed and depth as the company weighed service availability and other priorities. GMO plans to review its security architecture and investigate the cause with outside experts.
Customers who want to keep using a Windows desktop environment will be offered an alternative service on separate cloud infrastructure free for six months. GMO said it would email details of the ¥5,000 payment to eligible customers by Oct. 30, then publish the trading-claims procedure, required documents, application period and payment schedule by Nov. 6.
