Update: what GMO admitted at its briefing and the figures in its results, through Nov 13 (Onamae.com Desktop Cloud)

The main points first.

• At its November 2 briefing, GMO laid out the timeline from the intrusion to its own confirmation. It declined to say how the first VPS was breached.
• The November 13 results materials show how many compensation claims GMO has received. For losses from unauthorized trades, GMO had received claims from 2,943 accounts worth ¥2.99 billion as of November 12. These are claims, not final amounts. GMO says they become final after it checks them.
• GMO assumes direct costs from the incident of “¥3.05 billion in total,” to be booked in the fourth quarter. It has not revised its earnings forecast, and the extraordinary loss is “being calculated.”
• On November 6, on the orders of the head of the National Police Agency, a joint investigation headquarters was set up at the Tokyo Metropolitan Police Department.

##The figures in the results (Nov 13)

GMO Internet Group (securities code 9449) and GMO Internet (4784), which runs the service, released their third-quarter results on November 13. In a November 6 disclosure, GMO Internet said the amount of compensation “could not be calculated at this time” and that it would report on the claims at its November 13 results briefing.

The figures in the results materials are below. All are as of November 12, worded as in the materials. Page numbers are PDF pages.

Three things to keep in mind when reading these.

First, a claim is not a payment. The materials note that the ¥2.99 billion is “final after review of the contents by the company.” Compensation covers losses from trades that GMO, after investigation, accepts as caused by this unauthorized access (4th notice). The materials do not say whether the amount claimed will be the amount paid.

Second, the figures are written slightly differently in different documents. The notes in the earnings reports give the same November 12 compensation claims as “2,998 million yen” and the goodwill-payment claims as “54 million yen” (4784 earnings report p.16, 9449 earnings report p.21). They do not explain the difference from the ¥2.99 billion and ¥54.88 million in the presentation. The cap on the goodwill payment is also “up to ¥133 million” in the 4784 materials and “up to ¥130 million” in the 9449 materials.

Third, the ¥3.05 billion is given as the total of three items, but the amount expected for each item is not stated. The transcript of 4784’s results briefing goes through the goodwill payment, compensation for losses and the special goodwill payment in turn, then says that “this is the status of the costs expected to arise directly, and we assume ¥3.05 billion in total” (4784 results transcript p.6). It does not say how much is expected for each, so this post does not add anything up.

GMO has not revised its earnings forecast. The 4784 materials say the total cost “cannot be fixed at this stage,” because the goodwill payments and compensation are still being claimed and checked, and the investigation and security work are still under way. GMO says it will announce promptly if a large impact on earnings is expected (4784 presentation p.7).

The extraordinary loss for compensation and related items is “currently being calculated,” and GMO says it will announce promptly if the full-year dividend forecast changes (4784 presentation p.34). The earnings report says the total is “difficult to estimate at this time,” and that the incident had no effect on results for January to September and is expected to affect the fourth quarter onward (4784 earnings report pp.4 and 16).

What the results materials say, and what they don’t

Besides the figures, the materials say:

• The analysis of causes and issues, and the prevention plan, are “to be drawn up later” (4784 presentation p.8). The 9449 materials put it a little differently: the analysis of causes and issues “is being reviewed,” including how effective past efforts were and how the group was involved, and only the prevention plan is “to be drawn up later.” They add that GMO is considering a stronger system for reporting and escalating risk information (9449 presentation p.7)
• How governance should work is being discussed, led by outside directors and outside advisers, with an announcement “in the near future” (9449 presentation p.6)
• A group-wide emergency security check by the group’s white-hacker teams, using AI, is to be finished by November 14 (9449 presentation p.7)
• As of the results date, no unauthorized access or data leak at other services caused by this incident had been confirmed (9449 presentation p.4)

On the other hand, we found nothing in the four documents (both companies’ presentations and earnings reports) about restarting or ending the service, the name of a replacement service, or a review by an outside third party.

When we checked, the Q&A from the results briefing was marked “in preparation” on the 9449 IR page. The 4784 IR page has a transcript of the presentation part, which does not include the Q&A. It had no Q&A document or video link. We will add to this post when the Q&A is published.

##The compensation rules (4th notice)

The rules for compensation are in the 4th notice of October 24. Our earlier posts mentioned them in a single line, so here they are in full.

• Covered: realized losses to users from trades that GMO, after investigation, accepts as unauthorized trades caused by this incident. This means trading losses and fees
• Not covered: losses from market movements, profits the user might have made, and other indirect damage
• Checks: GMO decides what is covered using trade records, access records and other material. It may ask for more documents
• Claims: users submit information that objectively shows the date, details and loss of each trade. This includes identity documents and a read-only password (for MT4/MT5 and the like) so GMO can view the trading history directly
• Talking to the exchange: users are asked to explain to the exchange or broker that the trades came from unauthorized access, and to ask about cancellation and refunds
• Payment: if the exchange or broker refunds anything, GMO pays the rest. If the exchange or broker does not refund, GMO still pays the covered loss. If a user is compensated twice for the same loss, GMO may ask for it back

The 4th notice says GMO will never ask for passwords (other than the read-only ones) or PINs as part of the compensation process.

GMO checks each case on its own. This post does not judge whether any particular trade is covered.

On the broker side, Gaitame Finest said in its 4th notice on November 11 that it had emailed affected customers about compensation on November 6 and 10. Losses that cannot be objectively calculated, such as missed opportunities, are not covered. The broker writes that the compensation policy is GMO’s, and that it is cooperating with GMO’s compensation process.

##What GMO said at the Nov 2 briefing

GMO held a briefing on November 2 and streamed it on YouTube. We added part of it to the Oct 29 update on November 3. Here is a summary again. We checked the statements against the video’s auto-captions, and confirmed that the dates and numbers match Jiji Press’s summary of the briefing.

Hirofumi Yamashita, executive vice president of GMO Internet, gave this timeline:

• August 5: the culprit broke into a Remote Desktop VPS in a customer environment and stole an administrator account there
• August 17: the culprit abused those administrator rights to break into GMO’s management server
• September 20 to October 14: malware was pushed to customer VPSs through the management server. Up to 26,739 VMs could have been affected
• October 20: GMO confirmed this while investigating a customer inquiry. It had not noticed until then

GMO declined to describe the attack in detail, saying it could invite similar attacks and affect the police investigation.

As for users’ PCs, GMO said the culprit may have abused Remote Desktop’s drive-sharing feature to steal files from the PCs users connected from. It said this setting had been switched on at first, for users’ convenience.

GMO also admitted that experts at GMO Cybersecurity by IERAE had pointed out issues in the service in 2024. It held a briefing on the assessment results on April 24, 2024, and carried out four rounds of emergency maintenance from April 26 to May 20, but the measures were not enough.

President Tadashi Ito said that one record had been posted on the culprit’s site and that the service remains suspended (checked against Jiji Press’s summary).

On the same day, November 2, GMO Internet announced pay cuts: 25% for President Ito, 20% for Executive Vice President Yamashita and 20% for Senior Managing Executive Officer Kimihiro Kodama, each on monthly pay for three months from the December 2026 payment. The 30% cut for Masatoshi Kumagai is to the pay he receives from the parent, GMO Internet Group; the disclosure notes that GMO Internet pays him nothing. The disclosure says GMO “will review” what happened before the incident and will reconsider management responsibility in light of the results. It does not say the results of that review will be made public.

##The attacker’s claims next to GMO’s account

Below, what the attacker wrote on its own site (recorded in post 1) is set against what GMO said on November 2. The left column is the attacker’s claims, not verified facts. The right column is our reading.

One more date for comparison. The domain of the attacker’s statement site was registered at 15:26 UTC on August 31, 2026 (00:26 on September 1 in Japan), as we checked via RDAP in post 1. That is after the first intrusion GMO described (August 5). Only the order of the dates is known; it says nothing about any plan.

##Drive sharing: “the setting was on” is not “the line was in the .rdp”

What GMO admitted is that drive sharing was switched on at first on the service side. It did not say whether the distributed .rdp file contained the line drivestoredirect:s:*.

These are not the same thing. What the .rdp line means, and how to check your own file, are covered in post 3. What users should do has not changed.

##Police and government

• National Police Agency: the PDF of its November 6 release says the head of the agency issued an order (under Article 61-3 of the Police Act) that included setting up a joint investigation headquarters at the Cybercrime Control Division of the Tokyo Metropolitan Police Department’s Community Safety Bureau, for the case of violation of the Unauthorized Computer Access Act against GMO Internet. The main subject of the release is a separate group of large personal-data leak cases; this incident appears under “Reference.” As of November 13, the agency’s list of releases shows nothing further on this case
• Ministry of Internal Affairs and Communications: at a November 10 press conference, the minister said the ministry would start reviewing how telecom carriers should restrict access as a defense against cyberattacks, with a group of academic experts starting talks in late November. Asked whether the ministry had requested blocking in the GMO case, the minister declined to answer at both the October 30 and November 10 conferences
• Financial Services Agency: at an October 27 press conference, the minister in charge of financial services said GMO Internet “is not a business under the FSA’s supervision.” The minister also said five FX firms (Golden Way Japan, OANDA Securities, Ava Trade Japan, Gaitame Finest and Dukascopy Japan) had reported customer losses thought to be related to GMO Internet. The Oct 29 update cited Jiji Press for this; we have now confirmed it in the FSA’s record of the conference
• Tips to the bounty: 899 in total as of 18:00 on November 13. After an increase of 87 on November 4, the daily increase has been between 4 and 17 (added to the 16th notice’s page)

Some news reports say a North Korea-linked hacker group may be involved. According to the Sankei Shimbun, Kumagai said at the briefing that GMO had carried out specialist analysis and reported to the relevant authorities, and that there was nothing more he could say. GMO has not officially attributed the attack.

##What users should do

1. Claims for the goodwill payment (¥5,000 flat) close on November 30 (4784 presentation p.6). GMO has been contacting customers individually about the procedure (Oct 30 notice)
2. Before acting on any message about compensation or goodwill payments, check it on GMO’s official pages or contact points. GMO will never ask for passwords (other than read-only ones) or PINs as part of the compensation process (4th notice)
3. Changing passwords and checking .rdp files are as described before. The steps are in post 3

The contact points are the inquiry form (https://help.onamae.com/contact/, in Japanese) and the phone line 03-5456-2560 (24 hours, including weekends and holidays). These are the contact points listed in GMO’s notices of October 30 and November 6.

##What is still unknown

• How the first VPS was breached, and how the administrator account was stolen. GMO declined to say
• The findings of the review of the cause, and the prevention plan. The plan is “to be drawn up later,” and GMO has not said whether it will publish the review’s findings
• The final compensation amount, the extraordinary loss, and whether the insurance applies
• Whether the distributed .rdp contained the drive-sharing line
• Whether the culprit has been identified
• The name and details of the replacement service, and whether the service will be ended. In its 4th notice, GMO said it would not restart the service on the current platform that was breached, and would offer a switch to a replacement service run on an independent cloud platform (free for six months after switching). It began contacting customers individually on October 30. The notices do not give the replacement service’s name or details, or say whether the service will be ended. GMO’s list of official notices has nothing on this incident after November 6 (checked November 13)
• What was said in the Q&A at the November 13 results briefing