GMO Internet Group held its first press conference since the intrusion on the afternoon of 2 November in Tokyo. Chairman and president Masatoshi Kumagai said up to 26,739 virtual machines on the Onamae.com Desktop Cloud service may have been affected and reiterated that the company will not meet an extortion demand of about ¥8 billion. On the reported involvement of a North Korea-linked group he declined to comment on 'the name of any country or anything else', and the request for active cyber defence filed with the government on 24 October had not been applied as of the briefing.
From the 5 August intrusion to discovery in October
By the company's account, the attacker breached a customer's virtual private server on 5 August, stole an administrator account and reached the management server on 17 August. Malware was distributed to customers' VPS instances between 20 September and 14 October, and a customer inquiry on 19–20 October led to discovery. The company also acknowledged that files on users' own PCs may have been exposed through remote-desktop drive sharing. Details of the attack method were withheld, citing the risk of imitation and the ongoing investigation.
A demand of about ¥8 billion arrived on 21 October, and contact with the attacker has been dormant since 20:00 on 23 October. Kumagai said 'we will not pay criminals a single step of the way', and about 735 tips had reportedly reached the bounty programme (up to $1 million) by 18:00 on 2 November. On the weakness flagged in April 2024 by subsidiary GMO Cybersecurity by Ierae, he admitted the four emergency fixes completed by 20 May 2024 were 'not sufficient' and that the warning never reached top management.
Attribution reported to 'the appropriate authority'; experts sceptical
On Kyodo's report of a North Korea-linked group, Kumagai said volunteer specialists from security firms, including a former Interpol information officer, had carried out technical analysis and that 'we have duly reported that data to the appropriate authority', while declining any assessment including the name of a country. North Korean involvement therefore remains at the stage of a press report and a company submission to the authorities; neither the company nor the government has confirmed it.
TBS quoted Unknown Technologies' CEO Kirishiki as saying the evidence is 'too weak to call it North Korea', and Takayuki Sugiura of the Japan Hacker Association as viewing the fixation on a single company and the public ransom demand as 'the work of an amateur'. Because state involvement bears on both the first application of active cyber defence and the character of compensation, the government's attribution decision becomes the focal point.
Full compensation and a 'Cyber Aegis' proposal
On compensation, the company will fully cover realised losses from fraudulent FX trades, with procedures to be announced by 6 November. All customers receive a ¥5,000 condolence payment; where a personal-data leak is confirmed, a special payment of up to ¥3 million applies, and a replacement service is free for six months. Four executives including Kumagai take 20–30% cuts to monthly pay for three months from the December payroll; Kumagai denied he would resign.
On policy, Kumagai said he wants to propose a 'Cyber Aegis' concept to the Takaichi administration under which carriers would immediately block suspicious foreign IP addresses, likening AI-enabled attacks to a shift 'from handguns to machine guns'. The active cyber defence the company requested on 24 October had not been applied as of the briefing. A private firm publicly demanding the law's first use while the government withholds its decision is becoming the first case to define how the statute is operated.
Sources
Primary sources
- 4
【重要】お名前.com デスクトップクラウドサービスに対するサイバー攻撃について（第4報）
Source checked 3 Nov 2026
GMOインターネットグループ · External site
Reporting
- 1
GMO会見、サイバーイージス構想と全額補償｜お名前.com デスクトップクラウド不正アクセスで残った問い
Source checked 3 Nov 2026
Innovatopia · External site - 2
“北朝鮮ハッカー関与の可能性”に専門家からは懐疑の声も…不正アクセスでGMO社長が涙の初会見「犯罪者にお金払わない」【Nスタ解説】
Source checked 3 Nov 2026
TBS NEWS DIG（配信） · External site - 3
From developments to evidence and analysis
Background
No explicit relationship is recorded.
Evidence
No explicit relationship is recorded.
Follow-ups / later versions
No explicit relationship is recorded.
Related questions
Cite this article
AI & Security Observatory（2026-11-02）「GMO熊谷社長が初会見、最大2万6,739台の仮想マシンに影響と説明 国名への言及は避け、能動的サイバー防御は未適用」『AI & Security Observatory』、第1.0版、最終更新2026-11-03。https://ai-security-observatory.org/ja/brief/brief-20261103-02/
AI & Security Observatory (2026-11-02). GMO's Kumagai holds first press conference: up to 26,739 virtual machines affected, no country named, and active cyber defence not yet applied . AI & Security Observatory, version 1.0. Updated 2026-11-03. https://ai-security-observatory.org/en/brief/brief-20261103-02/
Version 1.0 · Publication date 2 Nov 2026 · Updated 3 Nov 2026
Revision history
- Earlier revisions have not been recorded.