Japan’s GMO cloud desktops hacked: What should people with trading accounts on the cloud do first?
Malware was planted in GMO’s “お名前.com” cloud desktop service. The company’s third update said that 26,739 servers may have been affected, and that login details for trading accounts stored on the servers may have been stolen. Its fourth update confirmed that user information had been taken, and some users reported trades they did not make.
The victims are mainly forex and stock traders who run MT4/MT5 on cloud desktops—not people whose crypto exchange accounts were hacked. The attackers are demanding about 8 billion yen and announced that they would release information and launch a ransomware attack at 11:00 a.m. Beijing time today. GMO says it will not pay the ransom and has reported the incident to the police. As of publication, the company’s latest update, No. 9, was posted before the announced deadline: no malware had been found so far on user computers that had completed analysis, but the analysis was not yet finished.
For crypto users, there are four things you can do right now:
1. Change your password using another clean device, then force-log out of all sessions. GMO specifically warns that old sessions may still be active.
2. Enable only the necessary permissions for your exchange API, and restrict access with an IP whitelist.
3. Never store your seed phrase or private keys on any cloud server or remote desktop.
4. Ignore anyone who claims they can “help you recover your losses” and asks for a fee.
Have you restricted your exchange API to an IP whitelist?
#账户安全 #网络安全 #MustReadForBeginners
Malware was planted in GMO’s “お名前.com” cloud desktop service. The company’s third update said that 26,739 servers may have been affected, and that login details for trading accounts stored on the servers may have been stolen. Its fourth update confirmed that user information had been taken, and some users reported trades they did not make.
The victims are mainly forex and stock traders who run MT4/MT5 on cloud desktops—not people whose crypto exchange accounts were hacked. The attackers are demanding about 8 billion yen and announced that they would release information and launch a ransomware attack at 11:00 a.m. Beijing time today. GMO says it will not pay the ransom and has reported the incident to the police. As of publication, the company’s latest update, No. 9, was posted before the announced deadline: no malware had been found so far on user computers that had completed analysis, but the analysis was not yet finished.
For crypto users, there are four things you can do right now:
1. Change your password using another clean device, then force-log out of all sessions. GMO specifically warns that old sessions may still be active.
2. Enable only the necessary permissions for your exchange API, and restrict access with an IP whitelist.
3. Never store your seed phrase or private keys on any cloud server or remote desktop.
4. Ignore anyone who claims they can “help you recover your losses” and asks for a fee.
Have you restricted your exchange API to an IP whitelist?
#账户安全 #网络安全 #MustReadForBeginners
