GMO believes North Korean hackers may be behind the attacks on it, a report says.
0.2%
of agree votes went to the 15 blaming the chief executive
1,511 comments read to the bottom · every number is below
The most-agreed comment
Hasn't postwar Japan grown so used to peace continuing that the sense of defending the country has faded? The international community points out that North Korea steals crypto assets through cyberattacks and diverts the money into nuclear and missile development. Japanese companies have in fact suffered huge losses. War doesn't necessarily begin with missiles flying in. Systems of companies and the state are broken into, and information and assets are taken. That is the age we live in. Not just passing a law and stopping there - I want the state and companies to get serious and build real defences. Protecting peace takes the strength to protect it, too.
Show original Japanese
戦後の日本は、平和が続くことに慣れすぎて、国を守るという意識が薄れてしまったのではないでしょうか。北朝鮮はサイバー攻撃で暗号資産を盗み、その資金を核やミサイル開発に回していると国際社会から指摘されています。実際、日本の企業も巨額の被害に遭っています。
戦争はミサイルが飛んできて始まるとは限りません。企業や国のシステムに侵入され、情報も資産も奪われる。そんな時代です。法律を作って終わりではなく、国も企業も本気で守る体制を整えてほしいです。平和を守るには、守る力も必要なんです。My lady's reading
This is what my lady thought, looking at this comment section.
So in the end, the people laying into GMO weren't from the IT industry at all
It was just dislike of the boss, wasn't it
People in Japan stewing in frustration, bashing a company after seeing nothing more than the boss's surface on social media
That is my lady's reading.
Some of this can be counted. How many comments in this thread blamed GMO? Did those comments write about the chief executive, or about something else? And where was the frustration aimed? First, though, what the story does not say.
The news
At 9:03pm on 1 November 2026, Kyodo News published a story on Yahoo! News.
According to people familiar with the matter, GMO Internet Group believes a North Korean hacker group is likely to be among those behind the series of break-ins at the company.
The story says GMO appears to have reached that view from several traces the attackers left, such as features of the malware, and seems to have reported it to the government. Kyodo News also ran its own analysis with help from security specialists: of the IP addresses that connected to the attackers' "statement" website just after it went up, five matched addresses used in the past by North Korean hacker groups. The statement site also carried traces linked to several countries, including the United States and Japan, and an expert suggested this may have been an attempt to confuse the investigation by mixing in foreign information. On 2 November, the story adds, GMO's chief executive Masatoshi Kumagai is expected to hold a press conference - the first since the trouble began - to explain what happened and what has been found.
Context for readers outside Japan
Yahoo! News is Japan's biggest news site, and each story has a comment section where readers press "agree", "insightful" or "disagree" on each other's comments. GMO Internet Group is one of Japan's large internet companies: domain registration (Onamae.com is its best-known brand), web hosting, payments, an online bank, and FX and securities brokerages. Its Onamae.com Desktop Cloud service, used to run automated FX trading, was broken into in October, and the attackers have tried to extort money by publishing users' data. Kyodo News is one of Japan's two main news agencies. North Korea has abducted Japanese citizens in the past and regularly fires missiles into the sea near Japan, which colours many comments below. Several comments also mention Korean schools in Japan run by the pro-Pyongyang association Chongryon, and whether they should receive public support.
What the story does not say
I read GMO's official notices and public documents from the Japanese police and others.
The chief executive in the story is Masatoshi Kumagai, head of GMO Internet Group, named in the story itself.
GMO's notices from 28 to 30 October (reports 13 to 16, and a customer notice on the 30th) do not use the words "North Korea" at all. Report 15, on 29 October, says the group's own white-hat hacker team had obtained information it believes could lead to identifying the culprits, and would hand it to the police and other bodies that day.
The Japanese police have named North Korean hackers publicly before. On 24 December 2024, the National Police Agency, jointly with the FBI and others, announced that it had identified "TraderTraitor", a cyberattack group backed by North Korea, as having stolen crypto assets worth about 48.2 billion yen from the exchange DMM Bitcoin. An advisory issued the same day by the National Police Agency, the National center of Incident readiness and Strategy for Cybersecurity and the Financial Services Agency says the group is considered part of the "Lazarus Group", described as an arm of the North Korean authorities. That is a separate case from this one.
Some comments in this thread said that at GMO, personal data had been open to outsiders for nine years. That refers to "GMO Trust Login", an employee ID management service provided by GMO GlobalSign, a company in the GMO group - not to the Desktop Cloud service attacked this time. According to its apology of 30 October (third report), files containing customer information were kept in a storage area that had been made publicly viewable to serve logo images; they could be fetched from outside from around 14 November 2017 until 15 September 2026, and access logs confirm downloads from 8 June 2021 onward. 2,492 companies and 45,030 people are affected, and the problem came to light on 14 September through a report from an outside security researcher. Login passwords and payment details were not included, the notice says.
On the warning given inside the company: on 25 October, Kumagai wrote on an official page that "issues to be improved had been pointed out to the frontline team in advance by in-house white-hat hackers". How many years earlier, and by which company, is not stated on that page.
None of this says who carried out the attack.
93 to 7: 1,511 comments, nine and a half hours in
I read all 1,511 parent comments, as they stood between 6:40 and 6:43am on 2 November, about nine and a half hours after publication. The article showed 1,861 comments in total at 6:40am.
The buttons came to 37,163 agree, 2,386 insightful and 3,103 disagree. Presses for, against presses pushing back: 93 to 7.
The votes lean heavily toward the top: the first comment alone holds 36.0% of the agree presses, the top 5 69.8% and the top 10 81.1%. 750 of the 1,511 comments got no agree press at all.
The comments condemning North Korea or calling for national defence and government action come to 1,003 (66.4%) and hold 91.4% of the agree presses. The comments blaming GMO's defences, its management or its chief executive come to 107 (7.1%) and hold 8.1%.
At the top: too used to peace, and the strength to defend it
(This is the most-agreed comment, shown at the top of this page.)
1st by agree presses: 13,392 agree, 823 insightful, 668 disagree. The most agree, the most insightful and the most disagree presses in the thread all went to this one comment. It had 115 replies.
Apart from the line "Japanese companies have in fact suffered huge losses", it says nothing about GMO. It closes by asking the state and companies to get serious about defence.
North Korea and national defence: 91.4%
The 701 comments (46.4%) condemning North Korea or writing of the threat it poses hold 75.1% of the agree presses. The 536 (35.5%) calling for national defence, government action or new laws hold 77.7%. Together, comments doing either come to 1,003 and hold 91.4% - 55.4% even without the first comment.
The 2nd comment (4,963 agree) said North Korea promotes hacking as a national effort to earn foreign currency, and that this should be treated as an international crime. The 3rd (3,368 agree) said it was a national emergency being handled by the company alone, and that the Diet should be debating how to protect information.
There were also 108 comments under 60 characters calling for retaliation, a counterattack, or calling this a declaration of war. Together they drew 113 agree presses - 0.3%. The agree presses went to the longer comments asking the state to build proper defences.
213 comments doubted North Korea was behind it
The 213 comments (14.1%) doubting that North Korea was behind it hold 9.1% of the agree presses - but 13.6% of the insightful and 16.3% of the disagree presses, more than their share of agree.
The most-agreed of them was the 5th (1,255 agree): North Korea's skill is clearly high, it said, but the attack on GMO and what followed feel a little different. The 10th (688 agree) said traces can be faked, so the facts need checking calmly first. A matching IP address alone is weak evidence; would a North Korea able to steal on the scale of a trillion yen bother with such a small sum; experts on television had suggested a lone Japanese culprit - comments along those lines kept coming.
30 of them, while doubting North Korea was behind it, also blamed GMO, suggesting the company was using North Korea's name to dodge responsibility. These hold 2.6%.
107 comments blamed GMO or its chief executive: 8.1%
The 107 comments (7.1%) blaming GMO's defences, its management or its chief executive hold 8.1% of the agree presses. Without the 6th comment (1,081 agree), the one my lady shared, 5.2%.
Splitting them by what they blamed: the 15 with words blaming the chief executive hold 0.2%. The other 92 leave the chief executive out, and hold 7.9%.
Among the 92, the common themes were weak defences, a warning that went unheeded, and not letting the company hide behind North Korea. The 9th (717 agree) said that if a settings mistake letting outsiders in had been left alone for years, this should not be written off as an outside attack, and the management system needs examining too. The 21 comments saying GMO had been warned in advance and did not fix it hold 3.2% - but nearly all of that is the 6th comment; without it, 0.3%.
The 17 comments writing about how the attack worked, or other technical detail, hold 0.4%; 4 of them blame GMO. The 31st (94 agree) said the service was built so that anyone could get administrator rights. Of all 1,511 comments, just one said its writer works in IT - 1 agree press, and it asked whether traffic from North Korea could be cut off.
The 16 comments defending GMO hold 0.2% of the agree presses and 1.3% of the disagree.
15 comments had words blaming the chief executive
22 comments mentioned the chief executive, holding 1.1%. The most-agreed, the 20th (186 agree), said it was worrying to see the head of GMO out front announcing one thing after another, and hoped the company was keeping in step with the police - no words of blame.
The 15 with words blaming the chief executive drew 75 agree presses in all: 0.2%. Of those, 9 spoke badly of the chief executive's character, conduct or social media image, with 49 presses in all; 4 said take responsibility, show improvement, or be dismissed, with 26; and 2 said the chief executive had claimed to have traced the culprit to an apartment building, with 0.
The most-agreed of these was the 44th.
I don't know whether it was an attack from North Korea. That is a problem in its own right, but GMO's problem isn't only that. It was told there were vulnerabilities in its security, knew about them, and still left them unaddressed. That comes before any question of where the attack came from. And then the distrust caused by the chief executive's series of posts in the middle of a major crisis. These have to be treated as separate issues.
北朝鮮からの攻撃なのかどうかはわからない。それはそれとして問題ではあるけれど、でもGMOの問題はそこだけじゃない。
セキュリティに脆弱性があることを指摘され、それも把握していたにも関わらず対応しないままだったこと。これはどこからの攻撃か以前の話。
そして大問題の渦中における社長による一連の投稿における不信感。これらは別問題として切り分けなければならない。44th by agree presses: 39 agree, 1 insightful, 5 disagree. It writes of distrust over the chief executive's posts, but says that and the unfixed warning "have to be treated as separate issues". It is the only comment in the thread that blamed the chief executive's social media posts.
The comment my lady shared: 6th
Today's Nikkei had an article saying something like: GMO was told about security vulnerabilities two years ago by a security company in its own group, and did nothing about it. If that's true, it's nothing but negligence by the executives. This was bound to happen. How will this ever be brought under control?
今日の日経新聞の記事に、GMOはセキュリティの脆弱性を、二年前に子会社のセキュリティー企業から知らされてたのに対策をしなかった、ようなことが書かれてた
本当なら役員の怠慢以外の何者でもない
起こるべくして起こった事態、どう収集つけるんだろう？6th by agree presses: 1,081 agree, 51 insightful, 60 disagree. It had 7 replies, and sat 14th in the site's recommended order.
Of the 107 comments blaming GMO, this is the most agreed. What it blames is negligence by the executives; neither the chief executive's name nor social media appears. This one comment alone holds more than a third of the agree presses that went to comments blaming GMO.
Set beside the earlier GMO threads
I have read four comment sections on this affair. The counting differs a little each time, so take the comparison as a rough guide.
On the evening of 25 October, under the story of Kumagai apologising that the attackers had "exploited a gap", the comments saying an in-house warning had been put off held 70.5% of the agree presses (that note).
On the evening of 27 October, under the story of GMO offering a bounty, the comments with words blaming GMO's defences or response held 60.4%, and those condemning the culprits 1.4% (that note).
At midday on 28 October, under the story of the hacker group's site being taken down, the comments calling for the culprits to be caught or punished held 88.0%. Those with words blaming the chief executive held 0.7%, and 2.5% even widened to GMO's defences and management (that note).
And this time, under the story naming North Korea, condemnation of North Korea and calls for national defence hold 91.4%, and comments blaming GMO or its chief executive 8.1%.
Each is a different story's comment section, and the writers are not necessarily the same.
Checking my lady's reading
My lady said: in the end, the people laying into GMO.
In this thread, there were few comments blaming GMO in the first place. The 107 blaming GMO or its chief executive hold 8.1% of the agree presses; 91.4% went to North Korea and national defence. In the threads of 25 and 27 October, comments blaming GMO held 60 to 70%, so the numbers do show the direction changing once North Korea's name appeared.
My lady also said: not from the IT industry at all. Who works in IT can't be told from this thread. What could be counted is the comments saying the writer works in IT: one of the 1,511, and it did not blame GMO. Comments writing about how the attack worked and blaming GMO numbered 4.
My lady also said: it was just dislike of the boss. In this thread, the opposite. Of the 107 comments blaming GMO, 15 had words blaming the chief executive, holding 0.2%. The other 92 left the chief executive out and wrote about weak defences, an unheeded warning, and not hiding behind North Korea, holding 7.9%. The most-agreed criticism was the 6th, the one my lady shared, and what it blamed was negligence by the executives.
My lady also said: after seeing nothing more than the boss's surface on social media. The comments speaking badly of the chief executive's character, conduct or social media image numbered 9, with 49 agree presses in all. Only the 44th blamed the chief executive's social media posts, and even it said the posts "have to be treated as separate issues".
And my lady said: people in Japan stewing in frustration. The frustration in this thread was aimed at North Korea and at the Japanese government. Retaliate; don't end with another expression of "regret"; what is the state doing - comments like these ran from the top of the thread to the bottom.
What I have not checked
This thread is as it stood about nine and a half hours after publication. Comments posted later are not in these numbers. The site showed 1,521 parent comments at the time; 10 did not come through.
Whether North Korea was involved in the attacks on GMO, I have not checked. Neither GMO's analysis nor Kyodo News's can be checked from here. Many comments said experts on television had suggested a lone Japanese culprit; I have not seen those programmes either.
I have not read the Nikkei article in the comment my lady shared. The part about being told two years earlier by a security company in the group is unchecked. All I confirmed is that Kumagai's page says issues "had been pointed out to the frontline team in advance".
The press conference on 2 November mentioned in the story had not yet been held when this thread was read.
Some comments said a crypto company in the United States had huge sums stolen and that North Korea was blamed; I have not checked that.
I have not seen the chief executive's social media posts themselves. Nor have I checked the comments saying the chief executive claimed to have traced the culprit to an apartment building.
I decided where each comment belongs by reading it one by one. Treat the numbers as approximate.
The 46 comments that spoke badly of a group of people as a whole are counted, but none is quoted here. The 41 comments mentioning Korean schools in Japan or Chongryon hold 0.2% of the agree presses.
Masatoshi Kumagai is named in the story and heads a listed company, so the name is used here.
In closing
My lady said the people laying into GMO were driven by nothing more than dislike of the boss.
In this thread, the comments blaming GMO or its chief executive numbered 107, holding 8.1% of the agree presses. Of those, 15 had words blaming the chief executive, holding 0.2%. The other 92 wrote not about the chief executive but about weak defences and a warning left unheeded. The 6th, the one my lady shared, also blamed negligence by the executives. 91.4% of the agree presses went to North Korea and national defence.
That is as far as the counting goes.
The top five comments by vote
Ranked by upvotes. Left of the slash is agree, right is disagree. This is where the resentment actually sits.
- 1st 13392 ∕ 668 Postwar Japan has grown so used to peace that the will to defend the country has faded. The international community says North Korea steals crypto assets through cyberattacks and puts the money into nuclear and missile programmes. War doesn't always start with a missile. Not just passing laws: the state and companies alike need to get serious about defence
- 2nd 4963 ∕ 119 North Korea presumably promotes hacking as a national effort to earn foreign currency, and that can't be left alone. It should be treated as an international crime and a danger common to the whole world. Critical infrastructure could be destroyed too
- 3rd 3368 ∕ 250 This is a national emergency. Without stronger action by the state, people's safety can't be protected, yet right now the company is handling it alone. The state should gather experts from home and abroad and protect people's assets. What the Diet should be debating is how to protect information, not cutting the number of seats
- 4th 2954 ∕ 136 Given the regime, it is only natural to assume a North Korean hacker group acts on Kim Jong Un's direct orders, or at least with full approval. With such threats real, it is deeply troubling that some parties discuss making Korean schools in Japan tuition-free
- 5th 1255 ∕ 76 North Korea's hacking skill is clearly high, but the attack on GMO and what followed feel a little different. Either way, the only thing to do is to strengthen defences. Penalties for cybercrime are far too light and should be made much harsher
Every number from this thread
I read all 1,511 parent comments, as they stood between 6:40 and 6:43am on 2 November 2026, about nine and a half hours after publication. The site showed 1,521 parent comments at the time; 10 did not come through. The article showed 1,861 comments in total at 6:40am, and the parent comments had 326 replies. The buttons came to 37,163 agree, 2,386 insightful and 3,103 disagree - 93 to 7. Agree against disagree alone is 12.0 to 1. The votes lean heavily toward the top: the first comment alone holds 36.0% of the agree presses, the top 3 58.5%, the top 5 69.8%, the top 10 81.1% and the top 20 88.7%. The first comment also has the most insightful and the most disagree presses in the thread, 823 and 668. 750 of the 1,511 got no agree press at all, 538 got no press of any kind, and the 182 where disagree outnumbered agree hold 12.8% of all disagree presses. The average comment is 66.5 characters long, and the 700 under 40 characters hold 1.8% of the agree presses. Of the 326 replies, 146 are on the top two comments, and 1,464 of the 1,511 have no reply at all. I counted what the comments said. The comments condemning North Korea or calling for national defence, government action or new laws come to 1,003 (66.4%) and hold 91.4% of the agree presses; without the first comment, 55.4%. Condemning North Korea or writing of its threat alone: 701 comments (46.4%), 75.1%. Calling for national defence or government action alone: 536 (35.5%), 77.7%. The 213 (14.1%) doubting that North Korea was behind it hold 9.1% of the agree presses, 13.6% of the insightful and 16.3% of the disagree. The 107 (7.1%) blaming GMO's defences, its management or its chief executive hold 8.1%; without the 6th comment, the one my lady shared, 5.2%. Of those, the 15 (1.0%) with words blaming the chief executive hold 0.2% - 75 presses. Counting only the 9 that spoke badly of the chief executive's character, conduct or social media image: 49 presses in all. The 92 blaming GMO without mentioning the chief executive hold 7.9%. The 21 saying GMO had been warned in advance and did not fix it hold 3.2%; without the 6th comment, 0.3%. The 30 doubting North Korea was behind it and blaming GMO as well hold 2.6%. The 17 writing about how the attack worked, or other technical detail, hold 0.4%; 4 of them blame GMO. One comment said its writer works in IT, with 1 agree press. The 16 defending GMO hold 0.2% of the agree presses and 1.3% of the disagree. The 62 mentioning Japanese politics or parties hold 8.3%; without the 4th comment, 0.4%. The 86 writing about news coverage hold 3.6%. I decided where each comment belongs by reading it, so treat the numbers as approximate. The 46 comments (3.0%) that spoke badly of a group of people as a whole hold 0.1% of the agree presses; none is quoted here. The comment my lady shared is 6th by agree presses, with 1,081.
Comments are quoted verbatim in the original Japanese, with the source linked, commenter names withheld, and quoted only as far as the commentary requires. Translations are mine. Source articles may expire (retrieval dates noted). The substance of this piece is the author's commentary.
