A serious cyberattack on GMO Internet’s Onamae.com Desktop Cloud has led to a service shutdown, confirmed removal of customer information, reports of suspicious trading-account activity, and a ransom demand of approximately ¥8 billion. As the investigation continues, the company is working with authorities, reviewing customer devices and asking the public to help identify those responsible.
The incident has raised concerns beyond an ordinary cloud-service outage. Some customers used the affected remote desktop environments to run financial trading software, meaning that information stored on those systems could potentially create financial risks if accessed by an unauthorized person.
GMO has confirmed unauthorized access and said customer information was taken outside the company. People believed to be behind the attack later published material they claimed was connected to GMO and its customers. The company has been verifying that material and says it will not pay the ransom because payment cannot guarantee that stolen information will be deleted or kept from being misused.
The euro and dollar figures are approximate conversions, not fixed values. The ransom demand was reported by GMO; it does not mean the company paid it. The number of potentially affected servers should not be interpreted as proof that every server was compromised.
What Is Onamae.com Desktop Cloud?
Onamae.com Desktop Cloud is a remote desktop service. Instead of doing all their work on a computer sitting in front of them, customers connect over the internet to a desktop environment hosted on remote servers.
These remote environments can be used to run software, store files and keep work sessions available without leaving a personal computer switched on all the time. Some customers used the service to run financial trading tools, including MetaTrader 4 (MT4) and MetaTrader 5 (MT5).
This use makes security especially important. A remote desktop may contain saved passwords, account identifiers, files, software configurations and active sessions. If an unauthorized person gets access to that environment, they may be able to view information or attempt to misuse the access available to them.
That does not mean every customer’s credentials were stolen or every trading account was accessed. The actual risk depends on which systems and data were reached. In this incident, however, customer reports of unfamiliar trading activity made the potential financial consequences particularly serious.
How the GMO Cloud Breach Unfolded
GMO’s official announcements describe an incident that developed over several days, from an initial customer inquiry to the shutdown of the service, the discovery of data removal, and a continuing investigation into threats made by people believed to be the attackers.
GMO says it began investigating after receiving an inquiry from a customer. At this stage, the company was looking into a possible problem affecting its Onamae.com Desktop Cloud service.
The company confirmed that a malicious programme had been installed in some customer server environments. GMO suspended new applications and access to the service’s control panel while it investigated the incident and worked to limit further damage.
GMO began progressively suspending servers across all plans to prevent further damage. It also published its first announcement about unauthorized access.
The company reported receiving a threatening email demanding approximately ¥8 billion. The demand was a threat from a person believed to be the attacker; it was not evidence that GMO had agreed to pay.
GMO later reported that 26,739 servers were potentially affected. That figure represented the potential scope of the incident, not confirmation that every server or customer had been compromised.
Customers reported unauthorized operations on trading accounts associated with tools used on the service’s servers. GMO warned that credentials for trading tools such as MT4 and MT5, as well as trading-account login information stored on the servers, might have been viewed by a third party.
The company advised customers to change passwords immediately from a different device, sign out of active sessions, review their transaction histories and balances, and contact their broker if they found transactions they did not recognize. It also advised customers to enable two-factor authentication where available.
GMO said it consulted police and was working with an external cybersecurity firm and relevant financial companies to investigate the incident and prevent further harm.
GMO confirmed that its investigation had found unauthorized access to the service and that customer information had been taken outside the company. It also acknowledged reports from customers who had seen transactions they did not recognize in their trading accounts.
The company announced a flat ¥5,000 payment for each eligible customer currently using the service, regardless of whether the customer had suffered a financial loss. It separately announced compensation for qualifying realized losses from unauthorized trading that its investigation confirmed were caused by the incident.
The company said the compensation policy had conditions: it covered verified realized losses and related costs, not losses caused by ordinary market movements, hypothetical profits that might have been earned, or other indirect damages. Customers were told to follow the official instructions for eligibility and claims.
GMO also said it was coordinating with securities and foreign-exchange firms to block unauthorized transactions, terminate active sessions and monitor for suspicious activity. It reported shutting down network connections on affected systems and blocking external routes for unauthorized access.
“We take very seriously the fact that we were unable to protect our customers’ information and assets in our own service.”
This statement appeared in GMO’s 24 October announcement. The company acknowledged its responsibility and said it would compensate customers under its stated policy and work to prevent a recurrence.
GMO asked customers to cooperate with an investigation of their devices. The company said it was arranging to collect devices for analysis by its white-hat hacker team and other specialists, with the aim of understanding the scope of the damage and checking whether malware, including ransomware, had been planted.
GMO repeated its requests to customers and began analysing devices that had been handed over for examination. It continued working with authorities and relevant organizations.
The company said people believed to be behind the intrusion had threatened further actions, including publishing information and carrying out a ransomware attack. GMO maintained that it would not comply with the ransom demand, because paying could not guarantee deletion of the data or prevent its unauthorized use.
GMO said that at 12:30 JST it confirmed that people believed to be the attackers had published information they claimed related to the company and its customers. The company was verifying the material and warned that some of it might be inconsistent with the facts.
GMO urged customers not to access or spread the alleged published information. It warned that people visiting the site could have their own information collected by the attackers, potentially creating additional harm. The company also said it was considering legal measures against malicious distribution of the material.
In its 13:55 JST update, GMO said a ransomware attack had not been confirmed. It said device analysis was continuing and that it was coordinating with authorities and outside organizations.
GMO reported that the site believed to have been used to publish the material had been taken down. It also launched the GMO Cybercrime Bounty programme to collect credible information that could help identify and apprehend those responsible and clarify the incident.
The programme set a total reward cap of US$1 million. GMO said it had received 113 submissions within the first six hours of the programme opening.
The company also reported that its white-hat hacker team was analysing devices supplied by customers. The devices examined at that point had not produced confirmed evidence of malware infection or ransomware, but the analysis was ongoing and more devices were expected.
In its latest update, GMO said the cybercrime bounty programme had received 270 submissions by 11:30 JST. The company thanked people who had provided information and helped prevent further spread of the alleged stolen material.
GMO also said its white-hat hacker team had independently obtained information it believed could help identify the perpetrators. It planned to submit that information to police and relevant authorities on 29 October.
This is a development in the investigation, but it does not mean that suspects have been publicly identified, charged or arrested. The company has not yet provided a final public account of the intrusion or the complete extent of the damage.
How Can a Cloud Breach Put Customers at Risk?
Imagine that you keep a computer in a locked office, but you use it remotely from home. You save files on it, leave some accounts signed in, and use it to run trading software. You expect the office and the computer to be protected by the company that operates them.
Now imagine someone gets into that remote computer without your permission. Depending on what they can access, they may be able to view saved information, look for account credentials or attempt to misuse an active session. If trading software is logged in, the risk can include attempted transactions or access to sensitive account information.
That is the basic concern with a remote desktop breach. The danger is not limited to the computer being unavailable. Information stored on the system may be exposed, and the incident can affect other accounts if passwords were reused or credentials were saved in the remote environment.
There are important limits to this example. Unauthorized access to a remote desktop does not automatically prove that every saved password was stolen, every account was entered, or every reported transaction was caused by the breach. Those details require investigation. GMO’s warning about potentially exposed trading credentials and customer reports of unfamiliar transactions are the reasons the incident has raised financial-security concerns.
What Information May Have Been Exposed?
GMO’s 22 and 24 October announcements provide the clearest confirmed information about the potential scope. The company said information stored on the service’s servers could have been affected, including login information for trading accounts saved in trading tools. It later confirmed that customer information had been taken outside the company.
- Information stored on servers: Data held in potentially affected customer environments may have been accessible to the intruder. The exact scope for each customer requires individual verification.
- Trading credentials: GMO warned that passwords and other authentication details for MT4/MT5 and related trading accounts might have been viewed by a third party.
- Unauthorized trading activity: Some customers reported transactions they did not recognize. GMO said it was coordinating with financial companies to investigate and limit further damage.
- Information allegedly published online: People believed to be the attackers published material they claimed was related to GMO and its customers. The company said it was checking the material and cautioned that some of it might be inaccurate.
- Payment-card information: GMO said it did not store customer payment information, including credit-card details, on the service’s servers. This is a specific statement about payment information, not a guarantee that no other personal or account information was exposed.
- Ransomware: GMO said ransomware had not been confirmed in its 27 October update. On 28 October, it reported no confirmed traces of malware or ransomware on the devices examined at that point. The investigation remained ongoing.
Confirmed facts and attacker claims must be kept separate. GMO confirmed unauthorized access and the removal of customer information. It also confirmed that people believed to be the attackers published material they claimed was connected to the company and its customers. The authenticity and full scope of that material were still being checked. A claim made by an attacker should not be treated as a verified finding.
Why GMO Refused the Ransom Demand
GMO has said it will not comply with the attackers’ demands. Its stated reason is that paying would not guarantee that the information obtained by the attackers would be deleted or that its unauthorized use would be prevented.
This is an important distinction in ransomware and extortion incidents. A payment cannot reliably force criminals to destroy every copy of stolen information, stop further threats, or avoid targeting the same victim again. In this case, GMO also said it had consulted police and other relevant authorities and was cooperating with them.
The refusal to pay does not mean the risk disappears. Criminals may still publish data, attempt to misuse credentials or make further threats. That is why the company has continued its investigation, issued customer guidance, coordinated with financial firms and asked the public not to spread the alleged stolen material.
GMO has also warned customers to be alert for phishing emails, text messages, phone calls and fraudulent websites exploiting the incident. People may use a real breach as a pretext to impersonate the affected company, promise compensation or ask victims to reveal passwords and authentication codes.
Customer Compensation and Protection Measures
On 24 October, GMO announced a flat ¥5,000 payment for eligible customers currently using Onamae.com Desktop Cloud. The payment was described as a gesture acknowledging the inconvenience and concern caused by the incident, and it was separate from compensation for losses resulting from unauthorized trading.
GMO also announced compensation for realized losses from unauthorized transactions when its investigation confirms that the transactions resulted from the unauthorized access. The company said the policy has conditions and does not cover ordinary market losses, profits that might have been earned, or other indirect damages.
The company said it was working with securities and foreign-exchange firms to block unauthorized transactions, terminate active sessions and monitor for further suspicious activity. It also reported shutting down affected network connections and blocking external routes for unauthorized access.
Customers should rely on GMO’s official announcements and direct communications to determine whether they qualify for compensation, what documentation is needed and how to submit a claim. The terms should not be assumed to cover every loss or every person connected to the service.
What affected customers should do
- Change passwords from a separate, trusted device. Do not use the potentially affected remote desktop to change credentials. Prioritize trading accounts and other services whose login details may have been stored on the server.
- End active sessions. Sign out of active sessions and use any available option to revoke other logged-in devices or sessions.
- Check account histories carefully. Review trading activity, balances and account notifications. Contact the broker immediately if you see transactions you do not recognize.
- Enable stronger authentication. Turn on two-factor authentication where available, and change reused passwords on other services.
- Follow official device guidance. GMO asked customers to cooperate with its investigation and issued instructions about powering off computers and disconnecting devices. Follow its latest guidance before reconnecting or using a potentially affected computer.
- Be alert for impersonation. Do not give passwords, authentication codes or payment details to unsolicited callers, messages or emails claiming to represent GMO or a compensation service.
- Do not visit or redistribute alleged stolen-data sites. GMO warned that accessing the suspected publication site could expose visitors’ own information. Avoid downloading, reposting or sharing the material.
- Use official support channels. Contact GMO through its published support page or phone number if you need incident-related help. Preserve relevant account records and communications for your broker or the company.
GMO lists its support contact form at help.onamae.com/contact and its telephone support number as +81-3-5456-2560, with service available 24 hours a day, including weekends and public holidays.
What Happens Next?
As of 29 October 2026, GMO’s investigation is continuing. The company has received hundreds of submissions through its cybercrime bounty programme and says its white-hat hacker team obtained information it believes may help identify the perpetrators. It planned to pass that information to police and relevant authorities.
Several major questions remain unanswered: how the attackers first gained access, which information was taken, how much of the published material is authentic, whether further attempts to misuse customer credentials will occur, and whether investigators can identify and apprehend those responsible.
The service shutdown, customer warnings, compensation measures and bounty programme show the scale of the response. But these steps do not, by themselves, establish the full technical cause of the breach or the final number of affected customers. Those conclusions require verified findings from the company and investigators.
For customers, the immediate priority is to secure potentially exposed accounts, review financial activity and follow official instructions. For other organizations operating remote desktop or cloud services, the incident is a reminder that protecting hosted environments also means protecting the information and accounts customers use inside them.
Sources and Further Reading
Official GMO announcements
Primary sources for the incident timeline, customer warnings, compensation policy and investigation updates.
- 21 October 2026 · Initial report GMO / Onamae.com — Initial notice of unauthorized access
- 22 October 2026 · Customer warning GMO Internet — Second report: potentially exposed trading credentials and affected servers
- 24 October 2026 · Data removal and compensation GMO Internet — Fourth report: confirmed data removal, customer payment and trading-loss compensation
- 27 October 2026 · Alleged data publication GMO Internet — Tenth report: published material, verification and ransomware status
- 28 October 2026 · Bounty and device analysis GMO Internet — Cybercrime bounty and investigation update
- 29 October 2026 · Latest update GMO Internet — 270 tips received and information planned for submission to authorities
- Official information portal GMO Cybercrime Bounty — Official information submission programme
Independent reporting
Additional reporting that provides outside context alongside the company’s own statements.
- 27 October 2026 · Cybersecurity news TechCrunch — Japan internet giant GMO says hackers posted stolen customer data
- Independent reporting GMO Internet — Customer security precautions and backup guidance
Editorial note: This report distinguishes GMO’s confirmed disclosures from allegations made by people believed to be the attackers. The incident remains under investigation, so details may change as additional verified information becomes available. Currency conversions are approximate and may vary with exchange rates.
Community discussion
Join the conversation
0 comments
Be the first to join in
There are no comments yet. Sign in to start a thoughtful discussion.
Sign in to comment
Join the conversation with your Secritic account. Comments are available to signed-in readers.