GMO Internet and Park24 disclose cyberattacks and pay users, report says

What happened

Japanese companies are paying compensation to users after a series of cyberattacks, according to a Reuters report published by Indian Express. The details below come from that single report and from statements it attributes to the companies. They have not been independently verified.

• GMO Internet Group: According to the report, GMO says customers will be compensated for losses from unauthorised access after a cyberattack on its foreign exchange trading service. CEO Masatoshi Kumagai said in a blog post on Sunday that all customers will receive 5,000 yen as “an initial gesture of good faith” (Indian Express).
• GMO extortion demand: GMO says it received a demand for money from a party believed to be behind the attack, together with a threat to disclose company and customer information. GMO says it will not comply and will work with police and other authorities. It will provide a free alternative service to customers for six months. It says it cannot yet calculate the impact on earnings (Indian Express).
• GMO request to government: GMO has asked the Japanese government to apply cyberdefence measures in response to the attack, according to the report (Indian Express).
• Park24: Park24, which operates the Times car-sharing service, said on Friday it will pay 3,000 yen to customers after a personal data breach. It says it will no longer keep identity document images once registration verification is complete. It expects an extraordinary loss of 5.5 billion yen from its response to the attack and the compensation payments (Indian Express).

The same report gives wider context:

• Government and company websites in Japan, Europe and elsewhere went offline last week after critical vulnerabilities in the PHP programming language were disclosed, which “prompted millions of hacking attempts” (Indian Express).
• Japan said it would set up a team that uses AI to simulate cyberattacks.
• TrendAI data counts 723 cybersecurity incidents in Japan in the year to October 20.

Not confirmed:

• How attackers got into GMO or Park24.
• What data was taken, and how many customers are affected.
• Who is behind the attacks.
• Any CVE identifiers, affected PHP versions or fixes for the PHP vulnerabilities.
• Whether the PHP flaws played any part in either company’s incident. The report does not say they did.

Am I affected?

• GMO: You may be affected if you use GMO’s foreign exchange trading service. GMO says all customers of that service will receive the initial payment. The exact service name and what data was exposed are not confirmed in the source.
• Park24: You may be affected if you registered with Times car-sharing. The company describes a personal data breach and says it is changing how it handles identity document images. Which customers and which data are affected is not confirmed.
• PHP operators: The report mentions critical PHP vulnerabilities but gives no versions or CVE identifiers. Whether your systems are affected is not confirmed by this source.

What to do now

1. If you are a GMO or Times car-sharing customer, rely only on official announcements from the company for details on compensation and on the six-month alternative service (GMO).
2. Treat unexpected messages about these payments with care. Confirm them through the company’s own channels before you act on any link or request.
3. If you run PHP applications, check the official PHP project for advisories and fixed releases. The source does not name versions or patches.
4. Watch for updates from GMO, Park24 and Japanese authorities. The entry point, data scope and attribution are not confirmed.

Sources

• Indian Express: Japanese companies compensate users as cyberattacks buffet economy