A North Korea-linked hacking group was likely behind a cyberattack on the Japanese company GMO Internet Group, according to the company's own analysis.
GMO's analysis pointed to the group because of characteristics of the malware used and other traces left by the attackers, sources close to the matter told Kyodo News.
The company appears to have already reported the matter to the government and is now working to establish the full circumstances.
Pyongyang has for years denied using state-linked cyber units for espionage and financial theft. It also categorically dismissed claims linking it to the record $6.3bn (£4.7bn) cryptocurrency heist at Binance.
Kyodo, working with security experts, found separately that five IP addresses used to visit a website claiming responsibility for the attack, immediately after it went online, matched those previously used by a North Korean hacking group.
Cybersecurity sources said the site also contained traces linked to several countries, including the US and Japan, which suggests the attacker may have tried to mislead investigators in a false flag operation.
The site’s domain was bought from a US company on 1 September and its hosting server came from the same company, its files were created in a US time zone, and its operating system was set to English.
Part of a programme that collected visitors’ logs contained Japanese text and had features suggesting it was generated by artificial intelligence, and files on the site were made with software developed in China and widely used there.
Another website, which invited victims to share information, may also have been set up by the attacker, security experts found on Saturday.
It was registered on 19 October, two days before GMO made the attack public, and was available as of 22 October.
Its design and source code are similar to those of the site claiming responsibility, and one of the experts described the two as “pretty much identical”.
The attacker may have used it to get information from victims, the experts said.
GMO apologised on Monday at a news conference in Tokyo, where its chief executive, Masatoshi Kumagai, and other executives bowed repeatedly.
The company confirmed that unauthorised access to its Onamae.com Desktop Cloud service led to leaked information and to transactions that customers did not recall making, affecting dozens of securities firms and other businesses, and said there were more than 26,000 cases. “I offer my deepest felt apologies,” Mr Kumagai said.
Mr Kumagai, who founded the company in 1991, acknowledged that GMO had been warned internally of a systemic weakness to such attacks but failed to take proper action. He is taking a 30 per cent pay cut for three months, and other top executives are taking smaller cuts.
He also apologised for recent social media posts, including a photo of him smiling, that he said may have hurt victims’ feelings.
GMO promised to compensate victims for their losses and to pay all its customers 5,000 yen (£22) as a gesture of goodwill, and said it will switch to a new security system. Japanese media reports carried interviews with several people who said large sums of money went missing from a GMO service although they had not made the transactions.
GMO shut down the Onamae Desktop Cloud service, which provides virtual desktops to financial traders, on 21 October after finding that it had been accessed without permission, and reported the incident to police the next day.
The company said on 27 October that about 27,000 servers may have been affected, and it has offered customers compensation and an alternative service. Last week it confirmed that customer information from its foreign exchange trading service was leaked and used in fraudulent transactions.
The hacker threatened to publish customer information and carry out a ransomware attack, in which data is locked until a payment is made. GMO did not respond to the demand, and some customer information was published on Tuesday. One victim said they received several emails on the night of 22 October from someone with a Russian-sounding name who claimed to be the attacker.
GMO’s authentication subsidiary, GMO GlobalSign KK, said separately that personal information of at least 45,000 people at client companies had been leaked through its employee ID management service.
The breaches have exposed weaknesses in Japan’s cybersecurity that some experts warn have been brushed aside for years and lack a sense of crisis.
Read MoreUS military in Japan rocked by second arrest of marine in less than a month
The bad habit that Japan wants tourists to stop – and that could actually be illegal
