Five IP addresses link GMO’s data leak to North Korean hacker groups

An attack involving services run by Japan’s GMO Internet Group has been linked to hackers associated with North Korea, though the attribution is described as likely rather than certain.¹² The reported numerical link is five: that many IP addresses used to access a website claiming responsibility matched addresses previously used by North Korean hacker groups.¹² That match is one part of the attribution, alongside malware characteristics and other signs left by the attackers.¹ The available reports do not establish a final finding about who carried out the attack; they describe evidence pointing toward a possible North Korean connection.¹²

The incident concerns unauthorized access to services operated under GMO Internet Group, rather than a stated finding about every service or all of the company’s systems.¹ The reporting describes the event as a cyberattack on the Japanese group and says the affected services had been accessed improperly.¹² The account does not specify how many users, customers, or records were affected, so the scale cannot be expressed through those measures from the available information.¹² The figure of five refers instead to matching IP addresses associated with visits to the claim site; it is not a count of affected people, compromised services, or stolen records.¹²

The evidence described in the reporting combines technical characteristics of malicious software with several other traces attributed to the attackers.¹ A separate clue came from a website where a claim of responsibility was published, and the IP-address comparison was made after that site appeared.¹ Five addresses that connected to the site were identical to addresses previously used by North Korean hacker groups, according to the reported comparison.¹² The matching addresses strengthen the reported association, but the sources still characterize the group’s role as probable rather than confirmed.¹²

Kyodo News conducted the IP-address work together with security experts, according to the South China Morning Post account.² The comparison was between addresses used to reach the claim site and addresses that North Korean hacker groups had used before.¹² Chinese- and English-language reporting both identify five matching addresses as a link to North Korean hacker groups, adding consistency across the two accounts.¹ That consistency concerns the reported address match; it does not turn the attribution into a definitive identification of the people behind the intrusion.¹²

The claim website also contained traces related to several countries, including the United States and Japan.¹ Those international traces complicate a straightforward reading of the website’s contents because they do not point only to the suspected North Korean connection.¹² The report says the foreign material may have been placed there to disrupt investigators’ work, but presents that possibility as an interpretation rather than an established fact.¹ The site’s multinational traces therefore sit alongside, rather than replace, the malware and IP-address evidence cited in the attribution.¹

GMO has reported the incident to the government, according to both the Japanese-language account and the South China Morning Post.¹² The reports do not provide details of what the government has done in response or what information the company submitted.¹² The company’s president, Masatoshi Kumagai, was expected to hold his first press conference since the incident began and explain its course and the facts then known to the company.¹ The stated purpose of that appearance was to describe the incident and the information GMO had gathered; the report does not give an account of what was said at the event.¹

The date given for the planned press conference is the second day of a month, but the cited account does not identify the month or year.¹ That timing is described relative to the start of the incident, as the first press briefing since the problem arose.¹ The South China Morning Post describes the cyberattack as having taken place the previous month, without supplying a calendar date in the cited information.² The material therefore gives a relative sequence—attack, government report, and planned company briefing—without enough detail to construct a complete dated chronology.¹²

For GMO, the directly stated consequences in these reports are unauthorized access to services and the need to explain the incident and the company’s known information.¹ The reports do not say how long the access lasted, what information may have been exposed, or whether services were disrupted.¹² They also do not give a count of affected customers or describe financial losses, so neither can be inferred from the five-address comparison.¹² The scope supported by the available descriptions is thus limited to the group’s affected services and the technical clues used to assess the attack’s origin.¹²

The attribution remains an assessment based on traces, including malware features, other attacker-linked signs, and the repeated use of five matching IP addresses.¹² A claim on a website does not, in the reported material, independently settle who conducted the intrusion, particularly because the site also carried traces tied to multiple countries.¹² The reports’ wording preserves that distinction: they connect the incident to a North Korea-linked group as a likely explanation, not as a conclusive public determination.¹² GMO’s report to the government and the planned briefing mark the company’s stated steps, while further clarification of what happened remains a central issue.¹²