GMO Internet desktop cloud breach draws $50 million ransom demand

The Register reported that Japanese internet provider GMO Internet has disclosed a compromise of Onamae.com Desktop Cloud, a virtual Windows desktop service it recommends for hosting foreign exchange trading applications. GMO said an outsider placed malicious programs on servers used by some customers.

In later notices, GMO said some customers reported unauthorized operations in their trading accounts, and it believes those customers' passwords for trading services were probably viewed by a third party. The company told users to change those passwords immediately from a device they do not use for trading, and to check their broker's guidance because some trading sessions can stay active even after a password reset.

GMO then confirmed the desktop cloud had security weaknesses, its environment was reached without permission, and customer information was taken outside the company. The ISP said 26,739 VDI servers may have been hit and users' own devices may also be at risk. It asked major trading services to end all active sessions, look for unauthorized trades, and block order requests coming from Onamae.com Desktop Cloud. GMO has also said investigations into the incident are continuing.

The company said it received a $50 million demand from a person believed to be the attacker, with a threat to publish company and customer information if the demand was refused. GMO said it will not pay, because payment would not guarantee that the stolen data is deleted or that it will not be misused. The company said some customers have reported transactions in their trading accounts that they do not recognize.

GMO is offering each customer a 5,000 yen, about $32, condolence payment and has committed to cover trading losses caused by the incident. CEO Masatoshi Kumagai wrote that the payment is a first sign of goodwill toward affected customers, and that the company will provide a free alternative environment for six months, rebuild its infrastructure, and bring in outside experts to investigate and stop a repeat.

Kumagai also acknowledged that GMO's internal white-hat hackers had earlier told the desktop cloud team about areas that needed work, but the team prioritized other issues and tried to avoid disrupting the service, so the fixes were too shallow and too slow, and the attackers used the gap. He wrote that GMO Group's security operation linked an unauthorized access campaign that hit about 20 Japanese companies to abuse of ARTEX, a penetration testing tool made for defense but used by attackers.

The CEO claimed open-weight AI models can now be blended into many attack tools, making cyberattacks possible without advanced skills, and that this threatens the internet he helped build. He said GMO has proposed to Japan's government that it apply proactive cyber defense, and that without protections at the national level, further incidents like this are unavoidable. Kumagai wrote that he is not trying to shift blame onto the government or request a bailout, but he argued that public and private groups must work together on security for Japan.

Update, October 27, 2026

Tokyo Reporter reported on Tuesday, citing TBS News, that GMO Internet said in a late-night Monday announcement that the attackers behind the Onamae.com Desktop Cloud breach had threatened to publish customer data and activate ransomware at exactly noon Tuesday unless the company complied. GMO said it has assigned its internal white-hat hackers to take direct control of affected customers' computers to examine the intrusion and remove the malware, and that it will inform affected users by email and on its website after specific countermeasures are ready. The company also urged users to run complete system scans and change passwords from a separate safe device, and warned that employees will never request passwords or verification codes and that offers to recover lost funds for a fee are fraudulent.

Update, October 27, 2026

The Japan Times reported on Tuesday that GMO Internet Group told account holders to prepare for the worst as a hacker group threatened to publish client personal data and launch ransomware at noon. GMO told users in a Tuesday statement to save copies of their data, disconnect the machine from the internet, turn it off and remove its power cord before noon. NHK reported after the deadline that the hacker group said it had made public information on one client because GMO refused to negotiate. Finance Minister Satsuki Katayama said on Tuesday that attackers had reached servers at five foreign exchange margin trading businesses connected to GMO and placed unauthorized online trades. She identified the firms as Gaitame Finest, Oanda, Ava Trade Japan, Dukascopy Japan and Goldenway Japan, and said those businesses have already suspended trades for the affected account holders. GMO said it is examining some clients' computers to understand the intrusion and create countermeasures, with Trend Micro among outside companies helping. The Japan Times also reported that Prime Minister Sanae Takaichi on Monday instructed the government to compile a package of cybersecurity measures by the end of next week.

Update, October 27, 2026

After the noon deadline passed, GMO Internet said on its Onamae.com news page that it had not confirmed any ransomware attack as of 13:55 local time on October 27. The company also asked people not to access or pass along material that attackers claim to have released, warning that doing so can spread malware and enlarge the damage to people named in leaked files.

Update, October 27, 2026

The Straits Times reported that GMO Internet Group has paused new subscriptions to Onamae.com and suspended its trading service since Oct. 21. A company spokesperson told the newspaper that every Onamae.com user could be affected because all of the cloud service's servers were compromised. On Oct. 26, GMO's stock fell the most since 2011.