GMO Trust Login Leak Exposes 45,030 Users via Logo Storage

GMO GlobalSign said on October 30 that a misconfiguration in its single sign-on service GMO Trust Login exposed names, email addresses and other data tied to 2,492 customer companies and 45,030 people.

The cause was a design decision: temporary files containing customer information were kept in the same public storage area used to serve logo images. Around November 14, 2017, the company had moved storage to that public area to cope with the load of delivering logos. Anyone who viewed the file list could download individual files, and the links carried neither a signature nor an expiry date. The company concluded the files were retrievable from roughly November 2017 until access was blocked on September 15, 2026.

What was exposed

Two kinds of files were affected. The first were files the system generated when customer administrators ran bulk operations, such as setting passwords on behalf of users, registering custom attributes or adding members in bulk. These template and error files held email addresses, names, connected app names and custom attributes such as employee numbers and affiliations. They cover 2,184 companies and 44,836 people.

The second were GMO GlobalSign's own contract files, containing company IDs, license counts, usage, cancellation dates and billing contacts' names, addresses, phone numbers and email addresses. Billing contact data was retrieved for 217 companies and 194 people, plus 91 companies that could not be identified. Login passwords, security questions, multi-factor authentication data, passwords for connected services and payment information were not included.

Discovery and response

An outside security researcher reported the problem through the company's vulnerability disclosure program on September 14. External access was shut off from that night until the following afternoon. Logs confirm third-party downloads from June 8, 2021; earlier logs do not exist, so those years were counted as potentially affected. An investigation by GMO Cybersecurity by Ierae, a fellow GMO group company that GMO GlobalSign calls an external specialist, found the data may have been obtained for malicious purposes.

The figures rose from the provisional numbers in the September 16 first report after the investigation found missing files and an error in the judging criteria. Regular penetration tests had covered applications and servers but not the storage layer, which is why the exposure went unnoticed.

The company now issues signed download links that expire after one hour and has disabled file listing everywhere. It will serve logos through a dedicated delivery system limited to approved file types, require data-handling reviews when designing file features, auto-delete customer files by retention period, and extend external audits to its whole cloud environment twice a year.