TOKYO - An 18-year-old Japanese cybersecurity expert has uncovered evidence suggesting that the hacker behind a major cyberattack on GMO Internet Group may be operating from Asia, as the company offers a reward of approximately 150 million yen for information leading to the attacker's identification and investigates more than 700 tips received from the public.
GMO Internet Group President Masatoshi Kumagai apologized at a press conference on November 2nd, his first since the attack came to light, acknowledging serious security failures that allowed hackers to infiltrate the company's foreign exchange trading systems, carry out unauthorized transactions and threaten to release customers' personal information unless financial demands were met.
"We sincerely apologize for failing to protect our customers," Kumagai said, becoming emotional as he spoke about his commitment to making the internet a safer place.
The attack, which first came to public attention in October, involved hackers gaining access to systems used for foreign exchange trading, with customers reporting transactions they had never authorized and substantial financial losses.
One customer discovered on October 22nd that someone had repeatedly executed trades through his account without permission, resulting in losses of approximately 3 million yen. "When I checked the transaction history, I found that 3 million yen had disappeared in about four seconds," he said, describing how dozens of trades had been carried out in rapid succession.
The customer subsequently received an email from someone claiming to belong to the hacking group responsible for the intrusion. The message suggested that the attackers had followed through on their threats because GMO had refused to negotiate.
The hackers had demanded money from GMO, warning that they would publish customers' personal information every day until the company complied. After GMO declined to meet the demands, information believed to belong to service users began appearing online.
GMO responded by offering an unusually large financial reward for information about the perpetrators, prompting cybersecurity specialists and members of the public to begin investigating independently.
At the November 2nd press conference, the company disclosed a detailed timeline showing that the intrusion had begun months earlier than previously understood.
According to GMO, the attackers first entered one of its servers on August 5th through an unknown method, subsequently gaining access to a server reserved for users and taking control of an administrator account.
On August 17th, the attackers used the compromised account to take over a server supporting foreign exchange trading and gain access to customers' computers. They then installed malicious software that enabled unauthorized transactions through customer accounts.
GMO acknowledged that security weaknesses in its systems had contributed to the incident.
"It is a fact that there were security problems in the system," Kumagai said.
The company also revealed that vulnerabilities had been identified internally two years earlier but that sufficient countermeasures had not been implemented. The warning had apparently failed to reach Kumagai, raising questions about the company's internal governance and procedures for escalating security concerns.
Asked whether he would resign to take responsibility, Kumagai rejected the suggestion, arguing that his responsibility was to help restore public trust in the internet.
"I cannot die leaving the internet contaminated by this malicious behavior in the name of taking responsibility," he said. "Please allow me to devote my life to making it a tool that brings smiles to people's faces."
While GMO has provided new details about how the attack unfolded, the identity and location of the perpetrators remain unclear.
One person who has submitted information to GMO is an 18-year-old university student living in Tokyo who operates under the name Active TK.
The first-year student, who entered university in April, began developing applications while still in elementary school and finished second in an international cybersecurity competition earlier this year.
Rather than attempting to identify the attacker through sophisticated intrusion techniques, Active TK concentrated on analyzing patterns in the suspect's online activity.
By examining the timing of emails sent to victims and access records associated with the attack, he compiled a timeline showing when the suspected hacker was active.
His analysis found that the attacker was generally active between approximately 11 a.m. and 2 a.m. Japan time, with no recorded activity between 2 a.m. and 11 a.m.
The pattern suggests that the individual follows a relatively conventional daily routine in a time zone close to Japan.
"If the person is operating according to a normal daily rhythm, there is a strong possibility they are in Asia," Active TK said.
The findings do not establish the attacker's nationality or exact location, but they provide investigators with a potential geographical lead.
Active TK also discovered an unusual detail involving a website established for victims to share information about the incident.
GMO confirmed the presence of malicious software on October 20th and announced emergency maintenance at 6:30 p.m. that day. However, domain registration records showed that the victims' website had been registered on October 19th, a day before the company's announcement.
The timing raised questions about whether the website was genuinely established by victims or had been prepared by the attackers themselves.
Active TK suggested that the perpetrators may have created the site as a platform to spread criticism of GMO and damage its reputation.
This possibility has prompted speculation that undermining confidence in the company, rather than simply obtaining money, may have been one of the attacker's objectives.
The investigation has also generated competing theories about the perpetrators' whereabouts.
One social media user suggested there was a 20% to 30% possibility that the attacker lived within the service area of a telecommunications exchange in central Osaka.
Kumagai responded to the post by thanking the contributor for the information, helping fuel speculation that the hacker might be based in Osaka.
Other online theories have suggested possible involvement by North Korean hackers, although no conclusive evidence supporting those claims has been publicly established.
Despite the volume of information gathered, GMO has declined to disclose whether investigators have narrowed down the suspects.
"We cannot make statements that might interfere with the investigative authorities," Kumagai said at the press conference. "At present, we have nothing to say about the name of any country or any other details."
Cybersecurity specialists examining the case believe that publicly available digital evidence could nevertheless provide important clues.
One expert analyzed access logs left on a website associated with the attackers' threats. The records contained details such as the times of visits, devices used, operating systems and browser versions.
Some entries showed access from Android 10 devices using Google's Chrome browser, with timestamps precise enough to establish when individual visits occurred.
Of particular interest were the IP addresses recorded in the logs.
An IP address can sometimes reveal the telecommunications provider used for an internet connection and provide an approximate indication of geographical location.
The expert demonstrated that one address appeared to be associated with KDDI's au network, possibly through a Wi-Fi connection.
"If this IP address belongs to the perpetrator, it could be an extremely powerful lead toward identification," the expert said, explaining that access to the provider's subscriber information could potentially connect an address to an individual.
However, the specialist emphasized that publicly available records alone are insufficient to identify the hacker conclusively.
Independent researchers can examine logs, compare timestamps and identify suspicious addresses, but they generally cannot obtain the confidential subscriber records held by telecommunications companies.
Investigative authorities, by contrast, can seek access to such information through legal procedures.
The expert said that if the attacker used a domestic telecommunications service and sufficient records remained available, authorities might be able to identify the suspect relatively quickly.
If the perpetrator was operating from overseas, the investigation could prove considerably more difficult.
Accessing records from foreign telecommunications companies may require cooperation with overseas authorities, and relevant logs may not always be available. In such circumstances, the investigation could extend far beyond two or three months.
The attack has also exposed broader concerns about cybersecurity at major Japanese technology companies.
GMO, one of Japan's leading internet groups, employs more than 200 white hat hackers and cybersecurity specialists, yet attackers were still able to exploit vulnerabilities and compromise customer systems.
The fact that security weaknesses had been identified two years earlier without adequate corrective action has intensified scrutiny of internal governance and management oversight.
Cybersecurity experts say the incident highlights a growing reality for companies and internet users: even organizations with substantial technical expertise cannot assume that their systems are immune to intrusion.
Companies must strengthen their ability to detect and contain attacks, protect sensitive information and respond rapidly when breaches occur, while individuals increasingly need to consider the possibility that accounts and personal data may be compromised.
For affected GMO customers, the immediate concerns remain recovering financial losses, preventing further unauthorized activity and determining whether their personal information has been exposed.
With more than 700 tips submitted to the company and investigators examining digital evidence left behind by the attackers, attention is now focused on whether those clues can be connected to a specific individual or group.
The case remains unresolved, but the investigation has demonstrated how even seemingly minor traces, including the time an email was sent, the registration date of a website or the IP address used to access a page, can provide valuable leads in tracking cybercriminals.
Source: KTV NEWS
