--- title: "GMO Trust Login public-storage data exposure" description: "GMO GlobalSign reported that customer files were downloaded from public storage, affecting 45,030 people at 2,492 companies." incident_type: "Data incident" status: "active" last_modified: "2026-11-03" canonical_url: "https://www.ally.security/incidents/gmo-trust-login-public-storage-exposure-2026" markdown_url: "https://www.ally.security/incidents/gmo-trust-login-public-storage-exposure-2026.md" stix_url: "https://www.ally.security/incidents/gmo-trust-login-public-storage-exposure-2026/stix.json" --- # GMO Trust Login public-storage data exposure GMO GlobalSign’s October 30 report confirmed third-party downloads of customer files from storage used by GMO Trust Login. Last modified Nov 3, 2026 · 1 source ## Summary - **Environment:** Public storage used by GMO Trust Login - **Operational impact:** 45,030 people at 2,492 companies affected - **Financial impact:** No incident cost disclosed ## What happened [GMO GlobalSign](https://trustlogin.com/)’s October 30 report confirmed third-party downloads of customer files from storage used by GMO Trust Login. [1](#source-1) ## Impact The completed investigation counted 45,030 people at 2,492 companies; people were deduplicated by email address. [1](#source-1) Data included names, emails, linked applications, custom employee attributes and billing contacts. Passwords, security questions, MFA and payment data were excluded. [1](#source-1) ## Timeline ### September 14, 2026 — Researcher reports exposure Researcher reports exposure, as described in the [company notice](https://news.trustlogin.com/20261030). [1](#source-1) ### September 15, 2026 — External retrieval blocked External retrieval blocked, as described in the [company notice](https://news.trustlogin.com/20261030). [1](#source-1) ### September 16, 2026 — First notice published First notice published, as described in the [company notice](https://news.trustlogin.com/20261030). [1](#source-1) ### October 30, 2026 — Final findings published Final findings published, as described in the [company notice](https://news.trustlogin.com/20261030). [1](#source-1) ### November 3, 2026 — Briefing updated This briefing was last reviewed and updated on November 3, 2026. ## Threat Group & Attack Vector Files were publicly retrievable from approximately November 14, 2017 until September 15, 2026. Downloads were confirmed in logs from June 8, 2021 onward; earlier logs were unavailable. [1](#source-1) Customer files shared public logo storage with directory listing and unsigned, non-expiring links. Storage had been outside routine testing scope. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response After a researcher’s September 14 report, access was progressively blocked by September 15. Subsequent measures included signed expiring links, file deletion, disabling listings and storage monitoring. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### GMO Trust Login customer information leakage — third report official · GMO GlobalSign · Oct 30, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** GMO Trust Login public-storage data exposure: The completed investigation counted 45,030 people at 2,492 companies; people were deduplicated by email address. 2. **Occurred At · 100% confidence · current** Final findings published: 2026-10-30 3. **Resulted In · 100% confidence · current** GMO Trust Login public-storage data exposure: After a researcher’s September 14 report, access was progressively blocked by September 15. Subsequent measures included signed expiring links, file deletion, disabling listings and storage monitoring. 4. **Resulted In · 100% confidence · current** GMO Trust Login public-storage data exposure: Files were publicly retrievable from approximately November 14, 2017 until September 15, 2026. Downloads were confirmed in logs from June 8, 2021 onward; earlier logs were unavailable. 5. **Resulted In · 100% confidence · current** GMO Trust Login public-storage data exposure: First notice published 6. **Affected Individual Count · 100% confidence · current** GMO Trust Login public-storage data exposure: 45,030 individual 7. **Occurred At · 100% confidence · current** Researcher reports exposure: 2026-09-14 8. **Discovered At · 100% confidence · current** GMO Trust Login public-storage data exposure: 2026-09-14 9. **Resulted In · 100% confidence · current** GMO Trust Login public-storage data exposure: External retrieval blocked 10. **Disclosed At · 100% confidence · current** GMO Trust Login public-storage data exposure: 2026-09-16 11. **Resulted In · 100% confidence · current** GMO Trust Login public-storage data exposure: Researcher reports exposure 12. **Occurred At · 100% confidence · current** First notice published: 2026-09-16 13. **Occurred At · 100% confidence · current** External retrieval blocked: 2026-09-15 14. **Resulted In · 100% confidence · current** GMO Trust Login public-storage data exposure: Data included names, emails, linked applications, custom employee attributes and billing contacts. Passwords, security questions, MFA and payment data were excluded. 15. **Resulted In · 100% confidence · current** GMO Trust Login public-storage data exposure: Customer files shared public logo storage with directory listing and unsigned, non-expiring links. Storage had been outside routine testing scope. 16. **Affected Organization · 100% confidence · current** GMO Trust Login public-storage data exposure: GMO GlobalSign 17. **Resulted In · 100% confidence · current** GMO Trust Login public-storage data exposure: GMO GlobalSign’s October 30 report confirmed third-party downloads of customer files from storage used by GMO Trust Login. 18. **Resulted In · 100% confidence · current** GMO Trust Login public-storage data exposure: Final findings published