A remote workstation can open other doors
A desktop accessed remotely can hold documents while also enabling transactions on services operated by other organizations, so defining an incident requires following the access that workstation made possible. In the Japanese Onamae.com Desktop Cloud case, I consider that connection decisive, because protecting a customer depends on reconstructing relationships between environments that do not necessarily coincide with the commercial boundaries of the purchased service.
In its second notice, published on October 22, GMO reported unauthorized programs discovered on October 20 in some server environments and identified 26,739 potentially affected servers. It also reported the possible acquisition and misuse of credentials used for trading, including through MT4 and MT5, citing customer reports of unauthorized transactions; it asked users to change passwords from outside the service and terminate sessions. The stated total described potential exposure rather than a count of confirmed compromises.
An examination result retains its own boundaries
The ninth update, issued at 11:59 a.m. Japan time on October 27, stated that no malware, including ransomware, had been found on submitted customer devices already examined, while analysis continued and not every device had been checked. In the same notice, publication of data and a ransomware attack announced for noon remained threats attributed to the presumed attacker, without establishing that computers had actually been encrypted.
That qualification deserves attention because a negative finding becomes more informative when we understand what the examination could observe. The device submitted, the period covered by its logs, and the tools used to inspect it define the significance of the result; extending it to unexamined workstations or credentials potentially used elsewhere would introduce a conclusion that the described examination cannot support.
In a comparable situation, I would therefore ask for each assurance to identify what was verified, allowing customers to understand whether it concerned the current presence of software, a particular session, or the absence of unusual transactions within a documented interval. Making the remaining uncertainties explicit gives the communication practical decision value, since customers can choose which activities to resume without having to interpret a general statement of safety.
Authorization can remain valid elsewhere
The separation between a workstation and the service it accesses becomes particularly important when an external authorization retains its own validity, because a desktop’s availability or shutdown does not necessarily describe the state of sessions established with third parties. For an organization using remote environments, reconstructing which identities were available and who can revoke them turns a contractual dependency into a set of identifiable operational responsibilities.
The environment provider and application operator need to be able to compare evidence across consistent timelines, distinguishing a suspicious login, a completed transaction, and any resulting financial loss. Without that reconstruction, a customer could receive technically correct statements from each party without obtaining an answer about the complete pathway through which someone could act in their name; this fragmentation of knowledge is itself relevant to the decision.
Taking down a domain does not recall copies
In its thirteenth notice, dated October 28, GMO announced the suspension of the domain publishing information presented as belonging to customers, while the sixteenth update, published on October 29, continued the collection of reports and efforts against further dissemination. These outcomes and activities should be assessed against the specific objectives they can achieve.
Ending access through a domain reduces one distribution route but does not establish that copies already obtained have disappeared. When assessing containment, I would therefore keep the outcome concerning publication separate from the revocation of reusable access and the examination of environments, since each answers a different question and requires its own evidence; customer communications should preserve those distinctions so that a visible success does not overshadow unresolved problems.
A reasoned basis for resuming each activity
The lesson I draw for Italian businesses concerns their ability to reconstruct an activity across the boundaries of the providers that make it possible. Before authorizing its resumption, I would want to connect the examined workstation to the identities used, sessions revoked, and transactions reconciled, specifying the gaps that could change the assessment; when these findings converge, the decision can be justified even before the entire investigation is complete. An assurance that extends the verified security of one component to the entire process would remain premature.