# The logo bucket listed the files

2026-10-31

GMO Trust Login’s third report says SSO bulk-operation files sat in a public logo-image bucket from November 2017. Confirmed takes from June 2021: 2,492 companies, 45,030 people after email dedupe. Storage was never in the pentest scope. Cards are out.

Canonical: https://www.fabiocti.com/notes/the-logo-bucket-listed-the-files/
Author: Fabio Correia

Nine years is a public folder that was supposed to hold a logo.

GMO GlobalSign’s Trust Login third report, posted yesterday and still the letter, says a researcher hit the vulnerability program on 14 September. The shop had put logo images in a storage prefix the internet could list. The same prefix also held the files the admin screen wrote when someone bulk-registered members, bulk-set passwords, or bulk-edited attributes — templates and error files — plus contract files. Listing the prefix was enough. There was no signature and no expiry on the links.

They had been able to fetch since about 14 November 2017, when logos were moved to that prefix to take load off the origin. Access logs only start 8 June 2021. Before that, they cannot say. After that, an outside lab confirmed takes. Count, after the lab finished: 2,492 companies, 45,030 people once emails are deduped. 2,184 of the companies sat in the bulk-operation files. Cards, they say, are not in it. No secondary use reported as of the 30th.

The pentest, they said, covered the app and the servers. It did not cover the bucket. That is the sentence.

## What 45,030 will be asked to cover

It will be briefed as every GMO customer, and as every SSO password in Japan. It is 2,492 Trust Login tenants and 45,030 people in files a logo CDN was willing to list. It will be briefed as the Onamae desktop. That is a different GMO incident. Do not add them.

If your company used Trust Login, the bulk file is the incident. A mail that already knows the tenant and asks the admin to “re-upload the password CSV” is not them.

The logo bucket listed the files. The pentest never opened it.