Kyodo reported on the night of 1 November that GMO Internet Group has told the government that, judging from traces including the characteristics of the malware used, a North Korea-linked hacking group is likely involved in the intrusion. The same day brought reports that a suspicious site soliciting information from victims may be linked to the attackers. Chairman and CEO Masatoshi Kumagai holds the first press conference since the incident on Monday afternoon.
What five matching IP addresses do and do not show
According to Kyodo, GMO assessed from multiple traces, including the characteristics of the malware, that a North Korea-linked group is likely involved and reported this to the government. In Kyodo's own analysis with security experts, five IP addresses that connected immediately after the attackers' claim site went up on 27 October matched addresses previously used by North Korea-linked groups. GMO handed substantive information on the attackers to police on 29 October.
The claim site contained traces pointing to several countries including the United States and Japan, which experts read as possible noise inserted to confuse investigators. Kyodo itself notes that matching IP addresses alone cannot establish that the same group was responsible, so attribution currently rests on the analysis of the victim and the press. An official judgement awaits the police and the National Cyber Office.
A fake victim forum and a warning from two years ago
NHK and Kyodo reported on 1 November that a site called the “information sharing forum,” which solicited information from victims, had been prepared before GMO disclosed the breach on 21 October. Its source code partially matched the attackers' claim site, and the hosting provider, Japanese-language code, folder names and access settings were common to both. The site has already closed with almost no visitors, and the attackers may have intended to use victims to pressure GMO.
Nikkei reported on 31 October that group company GMO Cybersecurity by Ierae had called for a fundamental review of the systems in April 2024, and Kumagai acknowledged on his blog that the depth and speed of the response had been insufficient. Tips under the bounty scheme reached 428 by 18:00 on 30 October, and applications for condolence payments and compensation close on 6 November.
A separate nine-year misconfiguration and the governance questions for the press conference
A separate matter surfaced on 1 November. In GMO Trust Login, an identity-management service of certificate subsidiary GMO GlobalSign, non-public files had been placed in a public storage bucket used to serve logo images and were retrievable from outside from November 2017 until 15 September 2026. The third notice on 30 October widened the scope to 2,492 companies and 45,030 individuals and confirmed retrieval by third parties. This was a misconfiguration distinct from the intrusion, with a final report to the Personal Information Protection Commission due on 12 November and main countermeasures by 30 November.
Monday's press conference will therefore face questions on the intrusion route and attribution in the Desktop Cloud case, on the response to the internal warning two years ago, on group-wide configuration management and on the scale of payments and compensation. Any statement on attribution feeds directly into the policy the government set at the 26 October ministerial meeting on cyber and into its decision on the first request for active cyber defence.
Sources
Reporting
- 1
- 2
- 3
- 4
From developments to evidence and analysis
Background
No explicit relationship is recorded.
Evidence
No explicit relationship is recorded.
Follow-ups / later versions
No explicit relationship is recorded.
Related questions
Cite this article
AI & Security Observatory（2026-11-01）「GMO不正アクセス、北朝鮮系集団の関与の可能性を政府に報告と報道 被害者を集める偽サイトも浮上、2日に初の会見」『AI & Security Observatory』、第1.0版、最終更新2026-11-02。https://ai-security-observatory.org/ja/brief/brief-20261102-02/
AI & Security Observatory (2026-11-01). GMO reported to have told the government a North Korea-linked group is likely behind the intrusion; a fake victim forum surfaces ahead of Monday's first press conference . AI & Security Observatory, version 1.0. Updated 2026-11-02. https://ai-security-observatory.org/en/brief/brief-20261102-02/
Version 1.0 · Publication date 1 Nov 2026 · Updated 2 Nov 2026
Revision history
- Earlier revisions have not been recorded.