In late October 2026, GMO GlobalSign reported that GMO Trust Login, its single sign-on service, exposed information for about 2,492 customer companies and roughly 45,030 people. Customer-related temporary and contract files had sat in a public storage area used for logo delivery for nearly nine years.
Passwords and payment data were not included, according to the company, but names, email addresses, linked service names, custom attributes such as employee IDs, and billing-contact details were. Third-party downloads were confirmed, and users were warned about phishing. Penzo appears on the eyecatch, pointing at a warned public folder.
What happened
A researcher reported the issue on 14 September 2026. A public storage area for logos also held bulk-operation template/error files and contract files. Directory listing and unsigned links made files fetchable. The open window ran from about November 2017 to 15 September 2026; confirmed downloads in logs start 8 June 2021. App/server tests had not covered storage settings.
The common design hole
Public static assets and customer-bearing exports must not share the same open bucket. Diagnostics that skip object storage, backups, and auto-generated CSVs leave the same blind spot. Even without passwords, name plus email plus service names fuel phishing.
Checks to run first
- No customer CSV, error logs, or contract PDFs in public buckets/CDN paths
- No public directory listing on object storage
- Signed, short-lived download URLs instead of guessable direct links
- Retention and auto-delete for temporary exports
- Storage and backups in the scope of security reviews
- Alerts when production public settings change
Design rules help: public-only delivery paths for public assets, private by default for customer files, and mandatory lifetime/delete plans. Inventory every store by purpose, exposure, personal data, and deletion method.
After a leak
Do not follow fake renewal or account-check messages asking for passwords or payments. Inside the company, inventory admins, stop password reuse, require MFA, and recover vendor accounts. Watch vendor incident mail for possible regulator reporting duties.
Summary
This case is the familiar mix of mixed public storage, listable unsigned links, and storage left out of tests. Start with bucket inventory, signed URLs, temp-file lifetime, and wider diagnostics. Prefer the official third report dated 30 October 2026 for counts and corrections.
Makoto Tejima can help with storage inventory, file-delivery design, and stronger admin auth. Please contact us.