Incident BriefingsGMO Trust Login public-storage data exposure

GMO Trust Login public-storage data exposure

GMO GlobalSign’s October 30 report confirmed third-party downloads of customer files from storage used by GMO Trust Login.

Last modified

Summary

  • Environment: Public storage used by GMO Trust Login
  • Operational impact: 45,030 people at 2,492 companies affected
  • Financial impact: No incident cost disclosed
  • Record status: Developing record. Reviewed November 3, 2026; updated as evidence emerges.

What happened

GMO GlobalSign’s October 30 report confirmed third-party downloads of customer files from storage used by GMO Trust Login. [1]

Impact

The completed investigation counted 45,030 people at 2,492 companies; people were deduplicated by email address. [1]

Data included names, emails, linked applications, custom employee attributes and billing contacts. Passwords, security questions, MFA and payment data were excluded. [1]

Timeline

  1. Researcher reports exposure

    Researcher reports exposure, as described in the company notice.

    [1]

  2. External retrieval blocked

    External retrieval blocked, as described in the company notice.

    [1]

  3. First notice published

    First notice published, as described in the company notice.

    [1]

  4. Final findings published

    Final findings published, as described in the company notice.

    [1]

  5. Briefing updated

    This briefing was last reviewed and updated on November 3, 2026.

Threat Group & Attack Vector

Files were publicly retrievable from approximately November 14, 2017 until September 15, 2026. Downloads were confirmed in logs from June 8, 2021 onward; earlier logs were unavailable. [1]

Customer files shared public logo storage with directory listing and unsigned, non-expiring links. Storage had been outside routine testing scope. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

After a researcher’s September 14 report, access was progressively blocked by September 15. Subsequent measures included signed expiring links, file deletion, disabling listings and storage monitoring. [1]