TOKYO (TR) – GMO Internet Group chairman Masatoshi Kumagai delivered a tearful, at occasions fiery efficiency at a press convention on Monday.
The Tokyo-based web large confronted mounting questions over a cyberattack that went undetected for greater than two months inside an organization that sells cybersecurity as a core enterprise.
Kumagai, who based GMO’s predecessor agency on the age of 27 and constructed it into a bunch of roughly 8,000 workers, was emotional however defiant. “I have never once used the words profit or money-making as a business goal,” he informed reporters. “I have always said: protect our customers’ information.”
“Hourglass of life”
On the query of a ransom demand, the chairman was unequivocal. “We will not pay criminals a single yen,” he mentioned, elevating his voice. “Their main objective is money. We will do nothing to encourage them.”
The press convention additionally produced a recurring and weird motif. Kumagai repeatedly invoked what he known as the “hourglass of life,” a philosophy constructed on the concept that, with 7.5 hours of sleep subtracted, an individual has solely 990 minutes of waking time every day.
He deployed the idea to induce effectivity on reporters, on his personal employees, and on himself, at one level snapping at a colleague mid-session to button his jacket. “You are here to apologize,” Kumagai mentioned sharply. “What are you doing with your jacket open?”
“Serious failure”
Beneath the theater, the substance was damaging. GMO disclosed that attackers had breached its programs greater than two months earlier than the corporate detected the intrusion. It additionally emerged that inside employees had flagged safety enchancment wants in 2024, prompting 4 rounds of emergency upkeep, none of which proved enough to forestall the breach, in accordance with the corporate.
Experts who spoke to the Japanese news program ‘news zero’ had been blunt. Masakatsu Mori, professor emeritus at Kobe University and a cybersecurity adviser to Kobe City, known as the two-month detection hole “a serious failure.” “For a company whose business is cybersecurity, two months is an extremely long time,” he mentioned. “If specialists had been conducting thorough daily checks, the intrusion could have been found much sooner. The fact that GMO, a company that offers security investigation and defense services, failed to find it for two months is a major problem.”
Uptime over safety
Yukimi Masuda of Japan Proofpoint supplied a extra measured view, noting that refined attackers intentionally transfer slowly to keep away from triggering anomaly alerts. “The standard playbook is to stay hidden and act in small increments so the numbers never look unusual,” she mentioned.
She added, nonetheless, that the obvious theft of administrator-level credentials represented a recognized and detectable assault vector. “There are many solutions that can flag privilege-escalation activity,” she mentioned. “I am very curious what detection systems GMO actually had in place.”
On the 4 upkeep periods carried out in 2024, Mori mentioned the vulnerabilities might have been closed if safety had been prioritized over service continuity, suggesting the corporate selected uptime over safety and left the failings in place. Masuda declined to evaluate whether or not the upkeep was enough with out understanding the character of the vulnerabilities concerned.
Kumagai acknowledged the breach would have ‘a negative impact’ on GMO’s model, however framed restoration in characteristically sweeping phrases. ‘It may take three years, five years, ten years, or even twenty,’ he mentioned. ‘But I want people to eventually say: GMO, well done. Turning disaster into fortune is what entrepreneurs do.’