GMO GlobalSign K.K., the authentication arm of Japan's GMO Internet Group, has raised the toll of a configuration error in its GMO Trust Login service. The service handles single sign-on and employee ID management. In its third report, published on 30 October 2026, the company counts 45,030 people across 2,492 client companies, up from the 2,007 companies and 37,747 people in its first, provisional figures. ITmedia NEWS, The Forward, BigGo and ITFIS all report the same totals, and ITmedia NEWS and The Forward say the company has called this its final investigation report. Customer files sat in a storage area that had been opened to the public to serve logo images, and they could be downloaded from outside from around 14 November 2017 until 15 September 2026. According to the company, access logs confirm that third parties downloaded files from 8 June 2021 onward, and it believes the data may have been taken for malicious purposes. This is a different incident from the October 2026 intrusion into GMO Internet's Onamae.com Desktop Cloud service and from the breach of the infoQ survey site run by GMO Research & AI.
What Happened
According to the third report as described by ITmedia NEWS and The Forward, an outside security researcher reported the problem through GMO GlobalSign's vulnerability disclosure programme at 17:48 on Monday 14 September 2026. From about 23:45 that night, the company blocked outside access to the files in stages and finished at 16:00 on 15 September. The third report corrects the first report on this point. The first report said blocking was completed "within 14 September", but in fact it ran overnight into the next afternoon.
The disclosure timeline:
- 16 September: first report published; the company starts contacting administrators at affected client companies one by one.
- 7 October: second report; the company starts sending guidance on reporting to Japan's Personal Information Protection Commission (PPC).
- 23 October: external forensic investigation completed.
- 30 October: third report published.
- 12 November (planned): final report due to the PPC.
The company says the count went up because, after the first round of investigation, it found it had missed some files and had applied the wrong criteria when deciding who was affected. The revised scope also adds billing contacts and administrator accounts that can no longer be linked to a company. ITFIS works out the increase as 485 companies and 7,283 people.
The forensic work was done by GMO Cybersecurity by IERAE. The company calls it an "external specialist organisation", but ITmedia NEWS points out that IERAE belongs to the same GMO group.
What Was Taken
According to the company's breakdown as reported by ITmedia NEWS and The Forward, two kinds of files were exposed:
- Bulk-operation files (2,184 companies, 44,836 people). The system created these files automatically when client administrators ran bulk actions in the admin console, such as setting passwords for users, registering custom attributes or adding members in bulk. They were template files and error files. They contained email addresses, full names, the names of connected apps, and custom attribute values such as employee numbers and department.
- Contract information files (217 companies, 194 additional people). These held company IDs, licence counts, usage status and cancellation dates. They also held the name, postal address, phone number and email address of each company's billing contact. ITmedia NEWS notes that the company has not explained why contract files were stored in the public area at all.
- 91 further companies could not be identified, for example because the administrator account had been deleted. No people are counted for these companies.
The people total counts unique email addresses, with duplicates removed. The company says no Trust Login passwords, secret questions and answers, multi-factor authentication data, passwords for the connected services, or payment card details were exposed.
Downloads can only be confirmed from 8 June 2021, because no access logs exist before that date. The company treats the period from 2017 to June 2021 as a period when files may have been taken.
Why It Matters
This is an identity provider that let its own customer data leak. The exposed files do not contain credentials, but they do show which employees at which companies use which connected apps, together with employee numbers and department names. That is useful material for targeted phishing. An attacker can send messages that impersonate a specific SaaS login page, aimed at named staff whose employer and tool stack are already known. Billing contact details make invoice fraud and fake vendor emails easier to pull off.
The long exposure is the second lesson. ITFIS notes that Trust Login announced ISO 27001 certification in January 2021, and that the misconfiguration went unnoticed for more than five years after that. The company says its regular security assessments and penetration tests covered applications and servers but not the storage holding the files. A certified management system and regular pen testing missed a public storage bucket because nobody had put the bucket in scope.
The incident also adds to scrutiny of the wider group. ITFIS describes three serious incidents at separate GMO companies within about six weeks. The first is this one. The second is the breach of the infoQ survey site, which ITFIS puts at roughly 900,000 records. The third is the intrusion into and extortion over Onamae.com Desktop Cloud, which TechCrunch reports may have affected 27,000 servers. ITFIS argues the three share weaknesses: design flaws, slow detection by the companies themselves, and thin explanations of root cause. The incidents are technically unrelated, and no source has linked them to a common actor.
The Attack Technique
There was no intrusion as such. According to the company's account, on around 14 November 2017 it moved a storage area to public access so that it could cope with the load of serving logo images. The system was also designed to write temporary files containing customer data into that same public area. Three failures combined:
- Listable bucket: anyone outside the company could retrieve the list of files in the public area.
- Unsigned, permanent links: file URLs carried no signature and never expired, so anyone who could see a file name could download the file.
- Assessment blind spot: the storage layer was outside the scope of regular diagnostics, so the exposure went undetected for about nine years.
The company has not said who downloaded the files from 2021 onward, or how many times they did so.
Remediation announced: ITmedia NEWS reports that download links now carry a signature and expire after one hour, and that file listing has been disabled in every storage location. The company also plans the following, with BigGo reporting a completion date of 30 November:
- serve public assets such as logos only through a dedicated delivery system that accepts only approved file types;
- run automated checks for files that should not be in public areas;
- require design reviews to cover data type, storage location and deletion method for any feature that handles files;
- extend external assessments to the whole cloud environment, twice a year.
What Organizations Should Do
- Trust Login customers: assume your staff list has been exposed. Warn the employees and billing contacts affected about targeted phishing that names your SSO provider or connected apps. Watch for fake invoice and vendor messages.
- Bring storage into assessment scope. Check that pen tests and configuration reviews cover object storage, CDN origins and static asset buckets, not just applications and servers.
- Turn off public listing and use signed, short-lived URLs. Audit every bucket for anonymous list permission. Serve any file that is not truly public through signed links that expire.
- Keep public assets apart from application data. Static content such as logos should live in a dedicated bucket that only accepts allowed file types. It should never share a location with temporary, export or error files.
- Find and purge temporary export files. Bulk import and export features often leave behind templates and error files that contain personal data. Map where they are written and enforce automatic deletion.
- Keep storage access logs long enough to matter. Here the lack of logs before June 2021 means nobody can know what was taken in the first three and a half years. Keep logs long enough to scope an incident properly.
Sources: GMO Trust Login leak hits 2,492 companies, 45,030 people | Japan internet giant GMO says hackers posted stolen customer data... | 【第三報】GMOトラスト・ログイン、2,492社・45,030人の情報が漏えい｜約9年間ファイルが外部から取得可能 The Forward | ロゴ画像用の公開領域に顧客ファイルも保存 GMO系シングルサインオン、4.5万人分漏えい - ITmedia NEWS | Japan's GMO GlobalSign exposes ID data of 45,000 people for 9 years... | GMO、見えてきた杜撰なセキュリティ体制 - ITFIS | Why did the attacker publish their own evidence? The Onamae.com Des... | GMO hack: experts narrow down the attacker from the extortion site'...