TOKYO (TR) – GMO Internet Group chairman Masatoshi Kumagai delivered a tearful, at times fiery performance at a press conference on Monday.
The Tokyo-based internet giant faced mounting questions over a cyberattack that went undetected for more than two months inside a company that sells cybersecurity as a core business.
Kumagai, who founded GMO’s predecessor firm at the age of 27 and built it into a group of roughly 8,000 employees, was emotional but defiant. “I have never once used the words profit or money-making as a business goal,” he told reporters. “I have always said: protect our customers’ information.”
“Hourglass of life”
On the question of a ransom demand, the chairman was unequivocal. “We will not pay criminals a single yen,” he said, raising his voice. “Their main objective is money. We will do nothing to encourage them.”
The press conference also produced a recurring and unusual motif. Kumagai repeatedly invoked what he called the “hourglass of life,” a philosophy built on the idea that, with 7.5 hours of sleep subtracted, a person has only 990 minutes of waking time each day.
He deployed the concept to urge efficiency on reporters, on his own staff, and on himself, at one point snapping at a colleague mid-session to button his jacket. “You are here to apologize,” Kumagai said sharply. “What are you doing with your jacket open?”
“Serious failure”
Beneath the theater, the substance was damaging. GMO disclosed that attackers had breached its systems more than two months before the company detected the intrusion. It also emerged that internal staff had flagged security improvement needs in 2024, prompting four rounds of emergency maintenance, none of which proved sufficient to prevent the breach, according to the company.
Experts who spoke to the Japanese news program ‘news zero’ were blunt. Masakatsu Mori, professor emeritus at Kobe University and a cybersecurity adviser to Kobe City, called the two-month detection gap “a serious failure.” “For a company whose business is cybersecurity, two months is an extremely long time,” he said. “If specialists had been conducting thorough daily checks, the intrusion could have been found much sooner. The fact that GMO, a company that offers security investigation and defense services, failed to find it for two months is a major problem.”
Uptime over protection
Yukimi Masuda of Japan Proofpoint offered a more measured view, noting that sophisticated attackers deliberately move slowly to avoid triggering anomaly alerts. “The standard playbook is to stay hidden and act in small increments so the numbers never look unusual,” she said.
She added, however, that the apparent theft of administrator-level credentials represented a known and detectable attack vector. “There are many solutions that can flag privilege-escalation activity,” she said. “I am very curious what detection systems GMO actually had in place.”
On the four maintenance sessions carried out in 2024, Mori said the vulnerabilities could have been closed if security had been prioritized over service continuity, suggesting the company chose uptime over protection and left the flaws in place. Masuda declined to judge whether the maintenance was adequate without knowing the nature of the vulnerabilities involved.
Kumagai acknowledged the breach would have ‘a negative impact’ on GMO’s brand, but framed recovery in characteristically sweeping terms. ‘It may take three years, five years, ten years, or even twenty,’ he said. ‘But I want people to eventually say: GMO, well done. Turning disaster into fortune is what entrepreneurs do.’
