An analysis by GMO Internet Group found a North Korea-linked hacking group was likely behind the cyberattack on the company in October 2026, sources close to the matter said. GMO said customer information tied to its foreign exchange trading service was leaked and used in fraudulent transactions, and some of it was disclosed on October 21, 2026. The company's GMO GlobalSign subsidiary said data on at least 45,000 people at client companies leaked.
GMO Internet Group faces claims from victims and a GMO GlobalSign leak affecting at least 45,000 people at client companies, while its foreign exchange trading service drew fraudulent transactions on leaked customer information.
GMO Internet Group Inc. concluded that a North Korea-linked hacking group was likely behind the cyberattack on the company in October 2026, people close to the matter said, pointing to characteristics of the malware used and other traces left by the attackers.
The Japanese internet infrastructure provider's foreign exchange trading service was the target. GMO said customer information tied to that service was leaked without authorization and used in fraudulent transactions, and some of it was disclosed on October 21, 2026, two days after a website claiming responsibility was registered.
Kyodo News, working with security experts, said five IP addresses used to access the website matched those previously used by a North Korean hacking group. The site's domain was acquired from a U.S. company on September 1, its hosting server was provided by the same company, file creation times were set to a U.S. time zone and the operating system was set to English, according to the report. Some code on the site contained Japanese text and showed characteristics suggesting it was generated by artificial intelligence, while files posted there were created with software developed in China.
Cybersecurity sources said the traces linked to multiple countries, including the United States and Japan, suggested the hacker may have tried to mislead investigators through a false flag operation. Security experts said a website set up for victims to share information may also have been created by the attacker, because its structure closely resembled the site claiming responsibility. That forum was registered on October 19, two days before GMO made the cyberattack public, and was confirmed available as of October 22.
The attacker threatened to disclose customer information and conduct a ransomware attack, the report said. GMO did not respond to the request. One victim said they received multiple emails on the night of October 22 from someone using a Russian-sounding name who claimed to be the attacker. GMO's authentication business subsidiary, GMO GlobalSign K.K., said personal information of at least 45,000 people at client companies had leaked through its employee ID management service.
An undated report from JKN said GMO had reported the matter to authorities and was analyzing the breach, and that the attacker demanded $1 million while GMO said it would pay the same amount as a reward to an informant. The body's primary account does not confirm those figures, and they were not used.
Pick the topics you care about. Get only what matters, on your cadence.