GMO Internet Data Breach: Hackers Leak Stolen Customer Data After Cloud Attack
TL;DR
- GMO Internet confirms it is investigating claims that customer data stolen in a breach of its cloud services has been posted online by hackers.
- The alleged leak reportedly includes customer names, contact details, and account-related information, though the full scope and authenticity are still being verified.
- Affected customers are urged to change passwords, enable multi-factor authentication, and watch for phishing emails while GMO works with experts and authorities.
What Happened
Japan's GMO Internet Group, one of the country's largest providers of internet infrastructure, cloud hosting, and domain services, says it is investigating claims that hackers have leaked stolen customer data online following a breach of its cloud services.
The company acknowledged the incident after threat actors claimed on a known leak forum and on social media that they had obtained internal databases and were publishing samples as proof. Security researchers who reviewed the posts say the samples appear to contain customer-related records, prompting concern about a wider release.
The investigation is ongoing, and GMO has not yet confirmed the full authenticity of all files circulating online.
What GMO Has Confirmed So Far
In statements released to customers and the press, GMO Internet said it detected unauthorized access affecting part of its cloud environment and immediately launched an internal investigation with external cybersecurity specialists.
The company says it has contained the affected systems, strengthened monitoring across its network, and reported the matter to relevant authorities. It has not yet disclosed the exact attack vector, but said there is no evidence so far that its core financial systems have been compromised.
GMO added that it will notify impacted individuals directly once verification is complete, in line with Japan's Act on the Protection of Personal Information.
Scope of the Alleged Leak
While the exact size of the breach remains unconfirmed, early reports from cybersecurity trackers suggest the leaked data could affect a significant number of cloud and hosting customers.
The files allegedly posted by the hackers are said to include names, email addresses, phone numbers, company names, contract details, and hashed passwords. Some posts also claim to include support tickets and configuration data.
Experts caution that leak-site claims are often exaggerated to pressure victims into paying ransom. Independent verification is still underway, and no complete customer database has been publicly confirmed as legitimate.
Analysts note that even partial leaks can be dangerous, as attackers can combine basic contact data with other breaches to launch highly targeted phishing campaigns.
How Did the Attack Happen
GMO has not publicly attributed the breach to a specific ransomware group or vulnerability. Security experts speculate the incident may involve compromised credentials, a misconfigured cloud API, or exploitation of an unpatched server, all common entry points in recent cloud attacks in Japan.
The group has a large attack surface, operating GMO Cloud, Onamae.com, ConoHa, Z.com, and multiple fintech subsidiaries. Investigators are now working to determine whether the intruders moved laterally between services or were limited to a single platform.
A forensic timeline, including when the hackers first gained access and how long they remained undetected, has not yet been released.
What Customers Should Do Next
Until GMO completes its review, all customers of GMO Internet cloud, hosting, and domain services should assume their contact information may have been exposed.
Change your GMO account password immediately and change it anywhere else you reused it. Enable multi-factor authentication on your GMO account, domain registrar, email, and cloud control panels.
Be extra cautious of emails, SMS messages, or calls claiming to be from GMO support asking you to click a link, download software, or provide payment details. Attackers often weaponize breach news within hours. Check your account activity logs, API keys, and billing records for anything unfamiliar, and rotate API keys and access tokens as a precaution.
Business customers should alert their IT and security teams, enforce password resets for staff, and monitor for lookalike domains that could be used for impersonation.
What's Next for GMO Internet
The incident puts renewed spotlight on cloud security in Japan, where regulators have been urging critical internet providers to improve disclosure and breach response.
GMO faces pressure to provide a detailed timeline, confirm exactly what types of data were taken, and offer protective measures such as free monitoring if personal data is confirmed leaked.
The company says it will publish updates on its official security advisory page as the investigation progresses. Further law enforcement action and potential claims from other threat actors reposting the data also remain possible in the coming days.
Get All The Latest Updates Delivered Straight To Your Inbox For Free!