Currency trading platform rocked by Japan hack and US$50m ransom

TOKYO – Hackers targeting a currency trading platform have published what they claim to be customer information after failing to receive a US$50 million (S$64 million) ransom, adding to a wave of cyberattacks in Japan that have prompted the government to draw up emergency measures.

GMO Internet Group, the subject of the latest attack, asked customers to scan their personal computers for viruses, back up their files and unplug and turn off their devices, and said that it would not agree to the hackers’ demands. The company has not confirmed a follow-up ransomware attack, which the hackers had also threatened, almost two hours after the noon deadline set by them. Some clients had earlier flagged transactions they had not initiated.

A GMO spokesperson said its trading service had been suspended since Oct 21, with the company also pausing new subscriptions. Every user of Onamae.com could be affected after all the cloud service’s servers were compromised, they added.

On Oct 26, the company’s shares tumbled the most since 2011 as concerns over the impact of a cyberattack deepened. GMO asked the government over the weekend to deploy active cyberdefence after its service were subjected to unauthorised access.

With dozens of businesses in Japan reporting breaches to their systems and potential leaks of client data in recent weeks, Finance Minister Satsuki Katayama said the nation would address the damage from the latest attack with a sense of urgency.

She said there was “a sense of crisis shared globally” over cybersecurity, as hackers harness artificial intelligence to take advantage of vulnerabilities. “Given how rapidly these incidents and circumstances evolve, we will continue to call on financial authorities to respond appropriately and swiftly as developments unfold,” she told reporters.

Katayama said earlier that five foreign exchange firms had reported customers affected by the GMO incident. She added that she had received no reports of new unauthorised transactions.

GMO sought government assistance on Oct 24 to help disrupt the source of the attacks. Hackers claim to have published personal information on one GMO customer, NHK reported without attribution. 

Emergency measures 

Prime Minister Sanae Takaichi instructed her Cabinet on Oct 26 to draw up emergency measures by the end of next week in response to the spate of cyberattacks.

Marito Ueda, president of SBI FX Trade, said the retail currency trading industry as a whole has recently been seeing customers closing dormant accounts, and that with interest rates rising, he expected some people to opt to put money back into bank deposits.

“Yet, those who were actively trading FX appear to have stayed in the market, as trading volumes have not declined,” he said. “If the fallout extends beyond FX and into equities for instance, it could become much harder to contain.”

At a regular press conference on Oct 27, Minister of Economy, Trade and Industry Ryosei Akazawa said the government would offer smaller companies free consultation services on boosting their cybersecurity.

Cyberattacks and the discovery of vulnerabilities in PHP programming language used in some websites have made a swift response an urgent priority for businesses and the government. Several political parties called for stronger measures last week.

In recommendations submitted to Takaichi on Oct 23, the ruling Liberal Democratic Party (LDP) said the recent wave of cyberattacks constituted a serious crisis that could be described as “the eve of a cyber emergency”, threatening Japan’s national security. It warned that “AI cyber saturation attacks”, in which AI automatically identifies system vulnerabilities and launches attacks simultaneously, could occur in the near future.

The party also proposed creating a response headquarters led by the prime minister’s office, while accelerating efforts to improve the capabilities of the Self-Defence Forces and police and strengthen cooperation with allies. In the financial sector, it called for the public and private sectors to work together to steadily implement defensive measures.

‘AI versus humans’

Masaaki Taira, a former digital minister who led the drafting of the recommendations, said attackers are using AI to mount hacks faster and on a broader scale than before, while companies are still relying on people to defend themselves. “Structurally, it has become AI versus humans,” he said. The government needs to work with leading AI companies to build a system capable of using AI for defence, he added.

One concern common is securing specialist personnel. With highly skilled private-sector cybersecurity professionals such as white-hat hackers in mind, the LDP called for the creation of a new personnel and compensation system that would “break through the rigidities of the civil-service system and enable compensation commensurate with market value”.  

Behind these proposals is a recognition that government salaries are insufficient compared with those in the private sector. According to the National Personnel Authority, the government can offer annual compensation of as much as 33.8 million yen (S$275,000) under its fixed-term appointment system to private-sector personnel with specialised expertise. The latest data show 490 people are employed under the system, but none is receiving compensation at the highest level on a monthly-pay basis.

“Annual compensation of 33.8 million yen is by no means low, but there are limits to how far that level of pay can attract people who are already highly valued in the private sector,” said Sumio Morita, senior managing director at human resources consultancy Towers Watson. BLOOMBERG