GMO Internet Group, listed on the Tokyo Stock Exchange Prime market, published a notice on 28 October setting out how it will respond to the attack on a service run by its subsidiary GMO Internet. The service is Onamae.com Desktop Cloud, and the notice carries a policy the group had published the previous evening as its 12th report on the incident.

Three decisions are in it, and all three are unusual enough to be worth reading in the company's own terms.

The refusal is written as a permanent policy

The wording is not hedged. The group says it will never meet demands from the attacker, and gives two reasons: meeting them guarantees neither the deletion of what was taken nor the prevention of its misuse, and there is a social responsibility not to encourage the crime.

Most victims who decline to pay say so quietly, or through a lawyer, or after the fact. Writing it into a stock exchange disclosure as standing policy is a different act, because it removes the option from future negotiations as well as this one.

The group adds that it is consulting the police and other authorities.

What it is paying its own customers

Instead of the attacker, the money goes to the people whose information was taken. The notice sets out 4 categories.

Every current user of the service gets a flat 5,000 yen, announced in the 4th report on 24 October. Separately, customers whose published information GMO has confirmed receive a special payment of 10,000 to 25,000 yen per category of information published, summed where several categories apply, capped at 3,000,000 yen per publication.

Customers who lost money through transactions GMO accepts as fraudulent in their trading accounts are compensated for the realised loss. Customers hit by ransomware are to be given a replacement machine of equivalent specification, although the group notes that as of its 10th report no ransomware attack had been confirmed.

The group states plainly that the total cost cannot be calculated yet.

A million dollars for information

The third decision has no obvious precedent in a Japanese corporate disclosure. GMO has created what it calls the GMO Cybercrime Bounty, funded by the parent company, to collect information leading to identifying and arresting those involved. The ceiling is 1,000,000 US dollars, roughly 150,000,000 yen, and the window opened at 12:00 Japan time on 28 October.

Read the three together and the economics are inverted on purpose. The attacker gets nothing, the victims get paid, and the budget that might have gone to a ransom is pointed at finding the people responsible instead.

What is still unknown about the attack

The group says information believed to relate to its customers has been published by someone believed to be the attacker, and warns that material it has not verified may contain things that are not true. It asks people not to access or redistribute it, and says it is preserving evidence and preparing legal steps against the worst spreaders.

Customer machines handed in for examination are being analysed by the group's own white hacker team, which is still establishing whether malware was planted at all.

As of the notice, no other group service is known to be affected.

What to take from it

  • A public, permanent refusal changes what an attacker can expect from the next victim, which is the only part of this that scales.
  • Paying victims directly is rare and expensive, and GMO has not said what it will cost.
  • Treat the published data as unverified. The company says some of it may be wrong, which is a hazard for anyone writing about it as fact.
  • Watch whether the bounty produces anything. A funded reward with a named ceiling is testable in a way that a statement of intent is not.

What is not established

  • How the attacker got in. The notices do not describe an access vector.
  • How many customers are affected, or how much the response will cost. The group says the total cannot yet be calculated.
  • Whether ransomware was deployed at all. Not confirmed as of the 10th report.
  • What the attacker demanded. The response policy states the refusal without stating the demand.
  • Who the attacker is, and whether the bounty has produced anything.
  • Whether any of the published material is genuine. GMO says it has not verified it.