Daily · Article 03 · 4 min read
- Security
GMO reports potentially identifying leads as submissions reach 321
Notices 15/16 dated October 29 · rechecked October 30 JST
Summary
GMO Internet said on October 29 that its own investigation obtained information it believes could help identify the perpetrators and would submit it to police. Submissions reached 321 at 18:00. Obtaining leads, intended submission and investigative findings are separate stages.
Where does obtaining promising information put an investigation? Japanese infrastructure provider GMO Internet reported internal leads in notice 15 on the breach of Onamae.com Desktop Cloud, a remotely accessed PC service, and updated submission totals in notice 16. These concern investigative information, rather than completion of individual device or account checks.
Key facts
Notice 15, as of 12:40 JST on October 29, says the group’s white-hat team independently obtained information it believes could help identify the perpetrators and would submit it to police and relevant organizations that day. White-hat researchers investigate vulnerabilities or intrusions for defensive purposes. This statement alone does not establish completed submission or confirmed identity. Notice 15
Notice 16, as of 20:50, records 321 cumulative submissions at 18:00, up 208 from 113 at 18:00 the previous day. The company says it is checking and examining the information. All times here are Japan time. Notice 16
1. Who established which stage?
Notice 15 separates public submissions from the group team’s own investigation. It should not be read as saying one of the 270 submissions had identified the perpetrator. What is public is the company’s assessment of its leads and its intention to submit them; neither notice describes their contents or a finding reached by investigators.
The company can pass material to police, while checking its reliability and connecting it to other evidence remain separate tasks. The diagram organizes the announcement; later stages are not marked complete.
%% From a lead announcement to investigative findings · public scope of GMO notices 15/16
flowchart TD
A["Company reports promising leads"] --> B["Submission to police planned that day<br/>No completion in these notices"]
B --> C["Next evidence to look for<br/>Investigators’ verification and findings"]The cat asks Q&A
The researcherWhich original statement should I look for after a submission is announced?
Pocket NotebookLook for official company or police updates separating submission or receipt from investigative results. A planned date passing cannot fill in completion. Without published contents, a reader also lacks material to independently assess the leads.
2. Does 321 count victims or validated leads?
Notice 16 counts information submissions. One person might submit repeatedly, information may overlap, or a review may find something less relevant. The number of useful leads remaining after such checks is separate from the intake total. It should not be converted into submitter counts or arrests.
| Observation time · JST | Cumulative submissions | Condition for reading it |
|---|---|---|
| October 28, 18:00 | 113 | First six hours after the channel opened at 12:00 |
| October 29, 11:30 | 270 | Interim total in notice 15 |
| October 29, 18:00 | 321 | Notice 16 total; 208 more than the previous day at the same time |
- Observation time · JST
October 28, 18:00
- Cumulative submissions
- 113
- Condition for reading it
- First six hours after the channel opened at 12:00
- Observation time · JST
October 29, 11:30
- Cumulative submissions
- 270
- Condition for reading it
- Interim total in notice 15
- Observation time · JST
October 29, 18:00
- Cumulative submissions
- 321
- Condition for reading it
- Notice 16 total; 208 more than the previous day at the same time
The check is 321−113=208. That increase spans 24 hours between the two 18:00 observations. It is not a like-for-like time interval with the first six hours producing 113 submissions. The company also announced publication of totals as of 18:00 on weekdays excluding public holidays.
The cat asks Q&A
- The researcher
Can more submissions be translated into a higher chance of solving the case?
Pocket NotebookIntake alone cannot provide that probability. Look next for verified information and investigative findings. Notice 16 says examination continues and asks people not to independently identify or contact suspected perpetrators.
3. Evidence for the entry path and for individual harm
A lead about who attacked and evidence explaining how they entered answer different questions. Notices 15 and 16 do not newly establish the specific initial entry path or the current state of each customer PC. Their lead announcement must retain that scope.
Earlier notice 14 reported no detected infection traces in devices entrusted to the company for analysis; its examined-device scope still matters. Notice 3’s guidance on existing connections, passwords and transactions needs records from the separate financial provider. Notice 14 · Notice 3
| Question | Evidence needed |
|---|---|
| How was the information used in the investigation? | Official company or investigator follow-up findings |
| How did the intrusion begin? | Published investigation findings with entry-path evidence |
| Did protection of my device and account take effect? | The device’s own results and the financial provider’s connection and transaction records |
- Question
How was the information used in the investigation?
- Evidence needed
- Official company or investigator follow-up findings
- Question
How did the intrusion begin?
- Evidence needed
- Published investigation findings with entry-path evidence
- Question
Did protection of my device and account take effect?
- Evidence needed
- The device’s own results and the financial provider’s connection and transaction records
The cat asks Q&A
- The researcher
What remains for someone who already changed their password?
Pocket NotebookGet evidence from the financial provider that old connections ended and check for unfamiliar orders or completed trades. An investigative announcement cannot change those records. The earlier follow-up explains device-reuse guidance and separate account checks.
To close
Follow the verified outcome next
The new information concerns leads the company says it obtained and the volume it received. Following what official updates actually verify lets readers keep intake, submission and investigative outcomes in view without collapsing them into a solved case.