Four Rounds of Maintenance Later: Why GMO's Security Warning Never Reached the Group Chairman

What the evidence in this incident supports is not that a specific vulnerability was left alone for two years. In April 2024, the group's own security company delivered the problems in this system to the vice-president level of the operating company, and the company ran four rounds of maintenance. The warning traveled no further: it never reached the group chairman, and the same assessment was never run again. Why it stopped there, the general counsel explained at the press conference: no standard had been set for which vulnerabilities had to reach the board — cases were judged one by one — and no quantitative standard exists even now.

Where the 2026 attacker entered, and whether that is the same place flagged in 2024, is something the company itself says it has "not yet established." This magazine does not draw that line. Its judgment rests only on the organizational break the evidence can carry. If the review the company has promised produces the escalation standard of the time, or records that the report did reach the chairman, this article's thesis falls, and this magazine will correct itself in public.

One — Thesis

Separate fact from judgment first.

The facts are these. In October 2026, a cloud service of one of Japan's largest internet groups was breached. Trading credentials customers had stored on its servers were taken out, and some customers booked real losses from unauthorized trades. The company first disclosed on October 21 and then published sixteen notices over the following two weeks. On November 2, group chairman Kumagai Masatoshi sat through a press conference of about three and a half hours, alongside the operator's president, its vice-president, and the general counsel.

But the line the press conference really opened was an earlier one. On April 24, 2024, the group's own security company had assessed this very system and put the problems on the table. The report reached the operator's president, Ito Masashi, and vice-president Yamashita Hirofumi; four rounds of emergency maintenance followed over the next month or so. And there the matter stopped. It never reached Kumagai — at the press conference he said plainly that it had not been escalated to him at the time. Why did it not travel upward? General counsel Kawasaki Yuki gave the specific reason at the press conference: there was no standard for which vulnerabilities had to be taken to the board; it was judged case by case. And on the day of the press conference itself, no quantitative standard existed.

So this magazine's judgment (OUR READING) compresses to one sentence. What the evidence in this incident supports is not that a specific vulnerability was left alone for two years, but a warning that stopped at the vice-president's desk. The warning was received, processed, and judged "settled for now" — and it never left that level: it did not reach the group chairman, and no standard required it to travel further. On the general counsel's account at the press conference, no such standard had been set.

The causality most easily misread is cut here. The specific content of the 2024 findings has never been made public by the company. Asked at the press conference whether the point breached this time was the point flagged two years earlier, Kumagai answered that the intrusion path has not yet been accurately forensically established. At least one link in the known attack chain — the drive-sharing setting used to take files from customers' own PCs — was, by the company's account, not among the items flagged at the time. The "flagged problem" in this article therefore means the problems in this system that were put on the table at the time, and whether that is the same door the attacker used in 2026 is something no one can currently prove. This article's thesis rests on the organizational break alone, not on that causality.

The falsifier is in Section Nine. If the review of the earlier handling that the company has promised produces the escalation standard of the time, or records that the report did reach the chairman, this article's thesis falls, and this magazine will correct itself in public.

Two — Cast first: a cloud desktop holding trading credentials is not an ordinary leak

The risk level of this incident is set by what was inside the servers.

Onamae.com Desktop Cloud is a cloud desktop operated by GMO Internet (4784). Users run FX and equity auto-trading programs on it around the clock, and the login credentials for their trading accounts were stored inside these servers. In its third notice, the operator spelled out the data scope: information stored on the servers includes trading-account login credentials saved in trading tools, among other items. Customers' payment information itself, by contrast, is not stored on these servers.

In other words, what the attacker took was not a mailing list but keys. The fourth notice, on October 24, confirmed that customer information had in fact been taken out. Reports of trades customers did not recognize had been arriving even before that. Credentials, unauthorized trades, realized losses — with that chain present, this is not the kind of incident measured by "how many tens of millions of email addresses leaked." The harm from an ordinary leak is probabilistic; the harm here is asset loss that has already happened.

Fix the operator's identity early, too. GMO Internet is itself listed on TSE Prime and is a consolidated subsidiary of the holding company (9449) — the company that took over the group's core businesses when the group moved to a holding structure in 2025. It is not an anonymous subsidiary hiding behind the group brand; it carries its own independent duty to explain itself to its own shareholders. That point matters when reading the pay-cut disclosures later: two listed companies disclosed on the same day, each on its own.

Fact

The written disclosure chain of this incident (FACT): the two companies' joint "Important Notice" series, reports 1 through 16 (continuously updated from October 21 to November 4, 2026), plus four rounds of TDnet timely disclosures by the two listed companies (October 23, 24, 28, and November 2). The scope of impact, the compensation structure, the extortion demand, and the pay cuts can all be verified in the original text of this written chain. What cannot be verified in it is the press conference. The company has published no transcript and no materials PDF — the most consequential facts, the 2024 findings, the reporting break, and the intrusion timeline, currently exist only as statements made at a press conference. Wherever this article cites the press conference, it says so.

Three — 76 days: the road the attacker walked

This section writes the detection line only, and names the evidence level of each link, because this is the line most easily misread.

The sequence Yamashita Hirofumi gave at the press conference runs like this. On August 5, 2026, the attacker entered one customer's cloud desktop and stole an administrator account; on August 17, using administrator rights, entered the management server; and from September 20 to October 14, distributed malware through the management server to other customers' cloud desktops. The remote-desktop drive-sharing function was also abused, and files on customers' own PCs may have been taken — the company acknowledged at the press conference that actual file theft had been confirmed, with the scope still under investigation.

When did the company learn? What is fixed in writing is this. On October 19, an inquiry from a customer started the investigation. On October 20, the presence of a malicious program was confirmed. At 4 a.m. on October 21, the first notice was published, and from that point the service was suspended in stages across all plans. On October 22, the company consulted the police.

From August 5 to October 20 is 76 days. Note the evidence structure of those 76 days: the starting point (August 5) exists only in the press-conference account and never appears anywhere in the company's written disclosure. The end point (October 20) is confirmed in writing. At the press conference, Yamashita acknowledged that the anomaly during this period had not been caught by the service's monitoring. Asked why it was not caught, he said he did not currently have the answer.

The detection break and the reporting break are different stories. This section is the former — the attacker walked inside the system for 76 days and no alarm sounded. The next section is the latter — two years earlier, an alarm did sound, but in a different place.

Four — The 2024 report: at which layer did it stop?

On April 24, 2024, GMO Cybersecurity by Ierae completed its assessment of this system and held a results briefing, together with a detailed engineer-to-engineer session. The specific content of the findings has not been made public by the company to this day. What can be documented stops at the level of "issues and improvement points concerning the system." Writing the findings as if they were a named, specific vulnerability would be writing without a source.

Who received the report? The press conference pursued this in detail. By Ito Masashi's account, the recipients were Ito himself (a group vice-president at the time), the business head, and Yamashita Hirofumi. Kumagai was not among them. At the press conference he said it plainly: it had not been escalated to him at the time. Whether the board as a whole knew remains unanswerable in writing — asked at the press conference whether it had been shared with the board, the company said it would answer after checking the minutes.

There is a detail that gives shape to the fact "there was no standard." At the press conference, Kumagai spoke of a group of 158 companies and 8,300 people, with reporting standards in place. General counsel Kawasaki Yuki then narrowed that account to this case: no quantitative standard for taking vulnerabilities to the board had been set at the time; it was judged case by case. That is a task for the future, and no quantitative standard exists even today. In other words, what was missing was not "the company had no reporting system at all." Of the staircase of that system, the one step that leads to the board did not exist.

There is one more structural problem. Ierae, which issued the warning, holds no authority to instruct or order the operating company. At the close of the press conference, Kumagai described Ierae's position at the time as like giving a "health check" to a sibling company: it could find things, but it could not compel what followed. "I should have stepped in and managed it myself; that is my responsibility." That one remark clarifies the shape of the division of labor: the assessing side held only the authority to report, while the authority to act and to escalate sat with the assessed side. What that side did is the next section.

Five — After four rounds of maintenance, who said "settled for now"?

From April 26 to May 20, 2024, the operator ran four rounds of emergency maintenance. At the press conference, Ito Masashi explained his judgment at the time: after the four rounds, he judged that the matter had "settled for now" — that it had reached a stopping point.

Yamashita Hirofumi filled in the reasoning behind that judgment. At the time, the work was being prioritized alongside service availability, other vulnerabilities, feature development, and performance work — and within that, the risk analysis was insufficient. Believing that the four rounds had gone deep enough was, in his words, "my greatest point of regret." The response, he said, was "insufficient in both depth and speed." Kumagai's summary was shorter: this warning "could not be put to use in the operation of the service."

Three absences fix what "settled for now" actually contained.

• There was no repeat assessment. Asked at the press conference whether the same assessment had been run on this system after the maintenance, Yamashita answered that it had not. After the four rounds, the system was never checked again by the same assessment.
• There is no official record of a fundamental rebuild. Nowhere in the sixteen written notices or the disclosures is there any statement that the architecture of this system was remade. The company has not published the content or depth of the maintenance, and this section does not fill that in by inference.
• There was no road upward. The report stopped at the vice-president level not because anyone suppressed it, but because, on the general counsel's account, the standard "this must go up" had never been set (Section Four).

Fact

An easily missed contrast (FACT): the admission "the 2024 response was insufficient" never appears in the company's sixteen written notices. The furthest the writing goes is the fourth notice's general statement that "a security problem existed in this service's system." Both "insufficient in depth and speed" and "could not be put to use" exist only at the November 2 press conference. That distance — between the written disclosure and what was said at the press conference — is itself one of this article's objects of observation.

This section's judgment can be placed here. The actions were all present — a briefing was held, maintenance was run, the responsible officer judged at the time that it had "settled for now." What was absent was threefold: a standard that required the matter to travel upward, a repeat assessment after the maintenance, and the upward step itself. The person who judged it "settled for now" and the people who received the report were at the same level. That is not a shape explicable by one person's negligence; it is the shape that appears when the reporting road is never defined as a system.

Six — The same group, another blind spot: Trust Login's nine years

Go back three months before the main incident. At 5:48 p.m. on September 14, 2026, an outside security researcher reported a problem to GMO GlobalSign through its vulnerability reporting program.

GMO Trust Login is an enterprise single sign-on service — one authentication that opens multiple business systems. Its design had a fatal placement. Files containing customer information were also being stored in the public storage area (a storage bucket) used to serve logo images. Temporary files the system created when an administrator ran bulk operations in the admin console, and contract information files, sat there, and the file links had neither signatures nor expiry dates. Anyone who knew a link could fetch the file. The final report's characterization (the third report, October 30) is explicit: this was not an external attack or intrusion, but a flaw in the company's own settings and design.

Write the period and scope in the third report's settled wording. The window in which files could be fetched from outside runs from around November 14, 2017 to September 15, 2026 — about eight years and ten months. The scope is 2,492 companies and 45,030 people — headcount deduplicated by email address, limited to what was contained in files "judged, by the company or by an outside specialist organization, to have been taken by a third party and to contain personal information." It is not all contract customers. Access records confirm access from June 8, 2021 onward; records before that do not survive, and the company treats that period as "possible." Login passwords and payment information are not included. As of the third report, no secondary damage had been confirmed.

Why did no one notice for nine years? The third report answers itself. Periodic assessments and penetration tests were being run, but their targets were the application and the servers, and the storage holding the files was outside their scope — which is why it went unnoticed for so long. And the outside investigation of this incident was run by Ierae — the same company that assessed the main incident's system. For GlobalSign it is an "outside specialist organization," but it is also a related company within the same 9449 group. Any citation of its investigation's conclusions has to carry that relationship with it.

Fact

The first report's figures are void (FACT): Trust Login's first report (September 16) carried provisional figures of 2,007 companies and 37,747 people. The third report corrected these to 2,492 companies and 45,030 people, and also corrected the first report's blocking timestamp and its statement of the "period in which access was confirmed." Where earlier coverage or planning materials carry the first report's numbers, this article replaces them all with the third report's.

This section's judgment (OUR READING): the main incident broke on reporting; this one broke on "scope." The warning's line upward, on the press-conference account, had not been set; the reach of the assessments was drawn by habit, not by the flow of the data. The two incidents' technical causes are unrelated — one an intrusion, one a design flaw — and the company has never linked them. There is exactly one reason to set them side by side: both happened inside the same group, and both broke where a security action met the system around it — in one case the destination it had to be reported to, in the other the reach it had to cover.

Seven — The same autumn: where did the others break?

This section only sets the cases side by side. Each company broke in a different place; what can be compared is machinery, nothing more.

Arara: the platform was breached, and the harm spread sideways. The email delivery service Arara Message (operated by a subsidiary of Paycloud Holdings) was breached. Through its servers the attacker entered client companies' environments — 97 servers, up to about 380 companies affected. Email addresses taken, or possibly taken, come to roughly 77 million — the company states repeatedly that this is a count of records, includes "possibly," and is not a headcount. The service was also abused to send phishing mail impersonating credit-card companies, up to about 7.13 million messages actually sent. The service was fully suspended on October 31. This is the only incident this autumn in which both exfiltration and abuse are officially confirmed. Its first report's figure of about 3.01 million records was corrected by its own second report, a week later, to roughly 77 million — the width of that correction is itself a lesson in disclosure calibration.

MUJI: the first report's "not included" list was overturned by the second report. Ryohin Keikaku's first report (October 30) said that what might have leaked from the MUJI app was email addresses, dates of birth, and gender, up to about 27.26 million records, and that names, addresses, and credit-card information were not included. The second report, on November 4, widened the scope to online-store users, about 520,000 of whom also had names, addresses, and phone numbers attached. More striking still: for MUJI Card members who joined before July 2021, full card numbers, Card IDs, and dates of birth — about 1.09 million records — entered the scope of "possibly accessed from outside." Those full card numbers were old data: obtained from the card company at the time in order to grant the company's own benefits, and still sitting inside Ryohin Keikaku's systems. The second report also states that, as of now, neither dark-web circulation nor misuse damage has been confirmed. The place of failure is clear. It is not "warned in advance." It is data kept after its purpose had ended, and a first report that wrote "not yet known" in a form very close to "does not exist."

ANA: the risk sat inside someone else's system. ANA's reservation system is provided by Spain's Amadeus. After Amadeus was breached, records for about 37,800 ANA passengers showed signs of having been viewed; about 1,700 of them include passport numbers and similar items (the scope covers reservations from August 10, 2023 to September 23, 2026; card information and passwords are not included). Japan Airlines, using the same vendor, had a combined impact of about 92,000 people. There is a timeline often repeated here — the vendor noticed the anomaly in late September, ANA heard of it in mid-October from another airline and inquired, and received the report a few days later. But that timeline appears only in media paraphrase of ANA's explanations; ANA's own written disclosure contains none of those dates. This article therefore keeps it as unconfirmed background and does not use it in any judgment. What can be confirmed is the structure alone: when the data is yours but the system is someone else's, ownership of the risk and ownership of the system separate.

Set side by side, one closing line. Four companies, four ways of breaking. The main incident's shape — "an advance warning with no road for reporting" — has no counterpart in the other three. What can be compared across them is only which link of each company's security machinery was never defined as a system: reporting, scope, retention, or the supplier.

Eight — FACT / OUR READING: security was the product, not the governance

Line up the FACTs first. What GMO Internet Group sells to the outside is, precisely, security. Ierae sells vulnerability assessment, penetration testing, and forensics support. GlobalSign sells identity management and authentication. In the autumn of 2026, two incidents inside the group itself broke: one on a warning that never traveled upward — on the press-conference account, no board-reporting standard had been set — and the other on assessments whose scope never covered the place that failed, by the company's own final report. Both sentences have sourced original text behind them. That is not rhetoric.

Our reading

OUR READING: what this group lacked was never security talent. Its own white-hat team found the problem in April 2024, and its assessment craft was trusted enough to run the outside investigation of another group company's incident. What was lacking was the machine that turns a serious finding into a board-level matter. Its first requirement is an escalation line — past which line a matter must leave that level's desk — and on the general counsel's account at the press conference, that line had not been set; the 2024 report stopped on the near side of it, at the vice-president level. Beyond it, this magazine would add four more written requirements: an owner (who carries the risk to the end), a deadline (by when it must be treated or escalated), re-testing (who checks again after the fix), and a signature for residual risk (when the decision is to keep operating while carrying the risk, who signs for it). Those four are this magazine's prescription, not established absences — the company has never published whether any of them existed.

The same absence of machinery also explains the shape of the sanctions after the press conference. The pay cuts are real, but they are an "evaluation at the present point in time," with the verdict on the handling of the time deferred to a later review. Kumagai refused to resign, giving as his reason that he wants to "clean up the internet before he dies." Whether to set up a review including third parties was, at the press conference, "under consideration." The verification of causes, the drawing of the line of responsibility, and the very structure of the press conference all currently circulate inside the same management. This magazine does not prejudge whether that machine can be built. It notes only that the measure of success is not the sincerity of the apology, but whether those requirements — the escalation line first — become a written system.

Add one small observation. This autumn's first reports all wrote "not yet known" in a form close to "does not exist." GMO's first report said no leak had been confirmed, and exfiltration was confirmed three days later (the first report's original text carried the qualifier "at the present time," leaving itself a way out). MUJI's first report's "not included" list carried no such qualifier, and was overturned by its own second report five days later. Arara's first report's count grew more than twentyfold within a week. This is not a question of any one company's character; it is a structural problem of disclosure sequencing. The fuller a first report is written, the more every subsequent report becomes a report admitting error.

Nine — What to watch: turning press-conference words into a checkable list

This article's judgment rests on published evidence. If the evidence changes, the judgment changes. In time order, five things to watch.

1. The company's review of the earlier handling (timing undecided). The pay-cut disclosure deferred the verdict on the 2024 handling to this review. If the review shows either of the following — that a documented board-reporting standard existed at the time and this matter was evaluated under it, or that the findings were in fact reported to the group chairman or the board — then, on either one alone, this article's thesis falls, and this magazine will correct itself publicly. Conversely, if the review merely retraces the press conference's account, the thesis is reinforced once.
2. The forensic conclusion on the intrusion path (timing undecided). This decides at which level the causality this article separated should be placed. If the path is established as unrelated to the 2024 findings, the causal weight between this article's thesis and this incident falls, and the lesson narrows to risk registers and reporting systems. If a relation is established, the cost of the reporting break gets repriced.
3. November 12, 2026 (the nearest checkpoint). GlobalSign is scheduled to file its confirmed report on Trust Login with the Personal Information Protection Commission as planned. Scope and characterization may be updated there.
4. The confirmed total of data actually taken (still unpublished). The sixteen notices have so far given only the total of what is "possible" (26,739 servers). Only when per-customer confirmed figures are published will the true size of this incident be fixed.
5. The first costing of the financial impact, and the conditions for restarting the service (both undecided). Compensation, the bounty, and response costs are still "cannot be calculated." Whether the desktop cloud restarts, and if so under what conditions, is the next touchstone of where this company places security in its priorities.

One last line. The cost of this incident has already been paid, in advance, by the customers — in credentials, in losses, and in two and a half months of suspended service. Whether it buys anything will not be decided by the sincerity of the next press conference. It will be decided by whether what this group issues next is an apology, or a standard.