The Warning Came From Inside the Building

On Sunday evening, the founder and CEO of one of Japan's largest internet companies published a blog post that every board member should read at least once. Masatoshi Kumagai of GMO Internet Group apologized for a breach that has shut down a cloud service used by foreign exchange traders, triggered unauthorized trades at multiple brokerages, and drawn a ransom demand he says was for 50 million dollars. Then he said the part that companies almost never say out loud.

His own security people had found the weakness first. The team responsible for the service took the warning seriously. They also moved carefully, weighing the impact on service availability against other priorities. The depth and speed of the response, in his words as reported, were insufficient. Attackers found the gap before the fix arrived.

That is not a story about a company that ignored security. It is a story about a company that did security the way most companies do it, and still lost. That is why it matters to you.

What happened

GMO's Onamae.com Desktop Cloud rents Windows virtual servers that customers use to run automated trading software around the clock. Many of those servers held saved logins for brokerage accounts. On October 19 a customer inquiry started an investigation. On October 20 GMO confirmed that a third party had installed malicious programs on some customer servers. At 4:00 a.m. on October 21 the company began shutting down every server on every plan. GMO said up to 26,739 servers may have been affected, and was careful to note that this is the number in scope, not a count of confirmed intrusions.

Then the second wave hit. From October 21 customers began reporting trades on their brokerage accounts that they had not placed. By Monday at least five Japan-licensed FX brokers, including OANDA Securities and FXTF, had confirmed unauthorized trades on client accounts and were restricting access, holding withdrawals, or forcing new authentication. The attacker claimed access to accounts at more than 70 firms. That larger number is the attacker's claim and has not been independently confirmed.

On October 24 GMO confirmed that customer information had been taken, disclosed the extortion demand, and announced that it will not restart the service on its current infrastructure at all. On Tuesday, after GMO refused to pay, the attackers posted online what they said was a customer's data. GMO has warned that anything the attackers publish may contain false content.

The market's reaction was blunt. GMO shares fell more than 13 percent on Monday, the first trading day after the compensation pledge, with some reports putting the drop closer to 16 percent. Analysts pointed to an open-ended liability: the company has promised to repay verified trading losses from the unauthorized trades, pay every current customer a goodwill payment of 5,000 yen, and provide a free replacement service for six months. It has said it cannot yet estimate the total cost.

The failure mode nobody budgets for

Here is what I want executives to sit with. The internal team did not miss the vulnerability. They were not negligent in the way a plaintiff's lawyer would love. They were doing a risk trade-off: patch now and risk downtime for thousands of paying traders, or sequence the work and protect availability. In most companies, most of the time, that trade-off is made by engineers and middle managers, and the board never hears about it.

In Cyber Risk Is Business Risk I argue that the board's job is not to pick the patch date. It is to make sure that the trade-off is visible, that someone with authority over the business owns it, and that "we'll get to it carefully" has an expiration date. GMO's own CEO now says the response lacked depth and speed. Those are governance words, not technical ones. Depth is a budget decision. Speed is a priority decision. Both belong to leadership.

This is also the clearest recent example of the difference between being compliant and being secure. Nothing in GMO's public statements suggests it was out of compliance with anything. It had internal testers finding real flaws, a team acknowledging them, and a plan. The attackers did not care about the plan.

The Three Questions, applied

The framework in the book asks three things. Are we secure? Are we compliant? How would we know if we were wrong? GMO's case turns the first question inside out. The honest answer in the weeks before the attack was "we know we are not, and we are working on it." The useful board follow-up is: for how long, at what exposure, and who signed off on that window?

The third question is the one that bites hardest. GMO learned it was wrong from a customer inquiry, followed within days by brokerages reporting fraudulent trades. That is the worst way to find out, because the damage lands on your customers and your partners before it lands on you. A company that has decided to accept a known risk for a period of time should be watching that specific risk harder than anything else in the environment, precisely because it already knows where the door is.

Why the shutdown matters

GMO's decision to kill the service rather than patch and restart is worth a board conversation of its own. It is expensive, it is public, and it is probably right. When the people who built the platform no longer trust it, the only defensible move is to replace it. Ask yourself whether your organization could make that call. Who has the authority to shut down a revenue-producing service on a Tuesday morning? If the answer is "the CEO, after a meeting," you have a response plan that depends on the CEO being reachable and the meeting being quick.

Kumagai has also asked the Japanese government to invoke its new active cyber defense framework against the attackers, arguing that no private company can fight cross-border attacks at this scale alone. Ministers met Monday, and an emergency package has been promised. That request is being watched closely in Tokyo. For a board outside Japan, the takeaway is simpler: do not plan on the government arriving in time.

What to ask your CISO this week

First, show me the list of known, unpatched, internally reported weaknesses that are more than 30 days old. Not the scanner output. The ones your own people found and wrote up. For each one, who decided to wait, and why?

Second, what customer credentials do we hold that we did not issue? GMO's servers stored logins for other companies' trading accounts. If your systems hold passwords, API keys, or tokens for your customers' accounts elsewhere, you are carrying their risk, and their regulators will see it that way.

Third, if we had to turn off our most important service today and never turn it back on, what would we offer customers tomorrow? GMO had a replacement service and a compensation framework announced within three days of confirming data theft. That did not happen by accident.

Fourth, what is our position on paying? Decide now, in writing, with the board's involvement. GMO's refusal was stated publicly before the deadline, with evidence handed to police and a warning to customers about what might get leaked. That is what a prepared refusal looks like.

The most uncomfortable line in Kumagai's post is also the most useful. The attackers exploited the gap between knowing and acting. Every company has that gap. The board's job is to know how wide it is.