GMO Trust Login is a single sign-on and employee ID management service operated by GMO GlobalSign K.K. On 30 October 2026, GMO GlobalSign published a third report putting the incident at 2,492 companies and 45,030 people, up from 2,007 companies and 37,747 people. GMO GlobalSign K.K. is the authentication arm of GMO Internet Group, and the report is described as the final investigation report. Employers deploy the service, so the people concerned are employees of client companies, not people who signed up individually. The incident was a configuration error: customer and contract files sat on storage that had been made public to deliver logo images, and that accessible state lasted from around 14 November 2017 to 15 September 2026.
Cause and exposure period
Storage handling was the source of the problem, in the company's account. A section of the storage that delivered logo images had been opened to the public, and files holding customer information, together with temporary files, were placed in the same section. Anyone outside the company could retrieve the list of files in that section. Individual file links carried no signature and no expiry date, so an outside party could open and take the files. The company's routine diagnostics examined applications and servers, but the storage section was outside that coverage, and the company gives that gap as the reason the exposure continued for years without detection. The accessible state began around 14 November 2017, when the storage was opened to the public as a logo-delivery area to cope with delivery load, and it ended on 15 September 2026. Blocking was introduced in stages from around 23:45 on 14 September 2026. It was finished at 16:00 on 15 September 2026.
Revised scope
The revised totals in the third report replace the earlier totals, and the people total counts email addresses after removing duplicates. Bulk-operation files account for 2,184 companies and 44,836 people whose personal information was acquired. Billing-contact information outside that group accounts for a further 217 companies and 194 people. A further 91 companies could not be identified because of administrator account deletion and similar reasons. The company explained the rise from the earlier figures as the result of missing files in the initial investigation scope and errors in the evaluation criteria, together with the newly included billing-contact and unidentifiable-administrator groups. The rise was not attributed to a new intrusion. The full third report is published by GMO Trust Login, and a summary of the same report is available from SmartScope.
Exposed data and excluded data
Two file types determine what was exposed, and the report describes the contents of each type separately. Bulk operations in the administrator panel produced files holding email addresses, names, names of linked services, and company-defined fields such as employee ID numbers and departments. Contract information files held company ID, licence numbers, usage status, cancellation dates, and the names, addresses, phone numbers, and email addresses of billing contacts. Addresses and phone numbers in that list belong to billing contacts only. They do not apply to all 45,030 people. Login passwords, security questions and answers, multi-factor authentication information, passwords for linked services, and payment information such as credit cards were absent from the files, according to the third report. The absence of passwords matters for the response: the company did not tell all users to change passwords solely because of this incident, while the company did warn about impersonation mail that draws on the details in the files.
Chronology of reports
14 September 2026 at 17:48 was the point of discovery, when an external security researcher reported the issue through the company vulnerability disclosure programme. The company states that this report led to discovery of the incident. 16 September 2026 was the date of the first report, and individual contact with administrators of affected clients began at that time. 7 October 2026 was the date of the second report, and guidance on reporting to the Personal Information Protection Commission began to be sent at that time. An external specialist organisation, GMO Cybersecurity by Ierae, investigated access records and configuration, and that investigation finished on 23 October 2026. 30 October 2026 was the date of the third report.
Two corrections in the third report revise the first report account. Blocking was finished at 16:00 on 15 September, not within 14 September as first stated. November 2017 was the start of the accessible state, not the confirmed start of acquisition as first worded, while third-party acquisition was confirmed from 8 June 2021 onward. No access records exist before 7 June 2021, so acquisition before that date cannot be confirmed, and the company treats that earlier period as a possible-acquisition period. As of 30 October 2026, the company stated that no secondary damage resulting from the incident had been confirmed.
Separate GMO incidents
Three different GMO incidents have circulated in the same news cycle, and the counts, dates, and attribution for each incident must not be merged. One different incident is the GMO Research and AI infoQ survey-panel breach. It was first reported on 6 October 2026 with a maximum of 948,498 members affected and members points cashed out as Amazon gift codes, and a second report on 14 October 2026 fixed the figure to 894,082 records. That incident concerned a survey site, a software vulnerability, and point fraud, and it is not the GMO Trust Login configuration error. Another different incident is the GMO Internet FX and Onamae.com Desktop Cloud unauthorised access. It was disclosed on 21 October 2026 with about 26,739 servers affected and reports of unfamiliar operations in trading accounts. On 1 November 2026, Kyodo News reported that sources close to the matter said an analysis by GMO Internet Group found a North Korea-linked hacking group was likely behind that cyberattack, citing malware characteristics and other traces. That attribution comes from sources reported by Kyodo, it belongs to the FX and Desktop Cloud incident only, and it is not an attribution for GMO Trust Login. The Kyodo report also notes, separately, that GMO GlobalSign said personal information of at least 45,000 people at client companies had leaked through its employee ID management service.
Measures for affected people
Administrators received individual notifications from the company, and administrators were asked to pass the details to team members. An employee check therefore runs through the employer administrator and the provider notification held by that administrator. The sources describe no public lookup for an individual check, and no self-service check is presented in this article. Third parties could misuse the acquired information to send mail or make calls impersonating the company, according to the company warning. Such messages could cite contract renewal, licence overage, or account verification, and could ask for ID or password entry or money transfer. The company stated that it never asks for passwords or other authentication information by mail or phone. Where contact is unrecognised, the company guidance was to avoid opening links or attachments in the message, avoid replying, and contact the company contact point or the employer administrator when unsure. The secondary summary of the report advised billing contacts who receive a request to change bank transfer details to verify the request separately using previously registered contact information. No password change was required by the notice for all users solely because of this incident. The exclusion of login passwords in the third report is the basis for that position. The impersonation risk described in how phishing uses your leaked email matches the company warning about messages that use employee ID details and linked service names. The question of which service leaked an address is covered in which website leaked my email.
An affected work address is probably in these files. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Investigation close
Investigation reporting was final in the third report, while reporting on preventive measures would continue. A final report to the Personal Information Protection Commission was scheduled for 12 November 2026, and monthly reports on the implementation of preventive measures were scheduled from 30 November 2026. Deletion of the files containing customer information took place on 24 September 2026, blocking of external retrieval of file lists in the affected storage took place on 25 September 2026, and blocking of that retrieval across all storage took place on 6 October 2026. A company press briefing by chairman and CEO Masatoshi Kumagai was scheduled for 2 November 2026, according to the Particle summary and the BigGo Finance summary of Kyodo reporting. The outcome of that briefing was not known when this draft was written, so no briefing outcome is reported here. Any update to this article should come from the scheduled commission report, the monthly preventive-measure reports, or a confirmed report of secondary damage, not from the other GMO incidents described above.
Top comments (0)