GMO GlobalSign K.K., one of our consolidated group companies, announced its third report on October 30, summarizing the investigation results and recurrence prevention measures for the leakage of customer information from “GMO Trust Login.” The leakage was first announced on September 16, 2026. In response, we are providing an overview of the investigation results, the impact on other services of our consolidated group companies, and the measures being taken to prevent recurrence.
We sincerely apologize for the considerable inconvenience and concern this matter has caused our customers and related parties, as well as for the burden placed on them, such as conducting internal checks and reporting to the Personal Information Protection Commission.
We have checked the other services of our consolidated group companies, including “GMO Sign,” an electronic contract service, for flaws similar to those in this incident. At this time, no similar flaws have been identified.
We take this matter very seriously and, as a group, will work to ensure that the recurrence prevention measures are reliably implemented
Overview of Investigation Results and Response
GMO GlobalSign became aware of this matter on September 14, 2026, after receiving a report from an external security researcher through its vulnerability reporting program. To deliver service logo images and similar content, GMO GlobalSign used part of its storage as a public area viewable from outside. This public area also stored files that the company’s system created when customer administrators performed bulk operations in the admin console, as well as the company’s contract information files. By referring to the file list, individual files could be retrieved. All external retrieval of these files was blocked by 16:00 on September 15, 2026.
- Period during which files were retrievable: around November 14, 2017 to September 15, 2026
- Period in which retrieval was confirmed in access logs: June 8, 2021 to September 15, 2026 (access logs for June 7, 2021 and earlier no longer exist, so that period is treated as one in which files may have been retrieved)
* According to an investigation by an external specialist organization, the affected customers number 2,492 companies and 45,030 individuals. This updates the provisional figures of 2,007 companies and 37,747 individuals announced in the first report.
- Information included: email address, name, target application name (linked service name), custom attribute values (items set independently by the customer, such as employee ID and department), and, from the company’s contract information files, company ID, number of licenses, usage status, cancellation date, and the name, address, telephone number, and email address of the billing contact
The following were not included: passwords used to log in to GMO Trust Login, secret questions and answers, multi-factor authentication information, passwords for the services accessed via single sign-on, and payment information such as credit card details.
GMO GlobalSign has reviewed its countermeasures from three perspectives: design (a private-by-default configuration), verification (pre-checks during the development process), and inspection (external security assessments and continuous monitoring), and will implement them by November 30, 2026 (some items by January 31, 2027). As of October 30, 2026, no reports of secondary harm resulting from this incident had been confirmed. Please be cautious of suspicious communications impersonating GMO GlobalSign that ask you to enter IDs or passwords or transfer money.
At this time, we expect the impact of this matter on our consolidated financial results to be minor.
Detailed Information and Inquiries
urther details are posted on the GMO Trust Login notice site. They include the breakdown of the number of affected customers, the types of information involved, the investigation results, corrections to the first report, and the full recurrence prevention measures. We plan to report the status of implementation on the same site every month, starting November 30, until all measures are complete.
- Apology and Notice Regarding the Leakage of Customer Information (Third Report)
- Inquiry form regarding this matter
(Japanese only)
Phone: +81-3-4545-2303
Hours: 10:00–18:00 Japan Standard Time, excluding weekends and Japanese public holidays
End