Japanese Internet Giant GMO Investigates Major Onamae Cloud Breach as Hackers Threaten Customer Data Leak

Key Points

• Data Leak Under Investigation: Japanese IT and cloud infrastructure giant GMO Internet Group is actively investigating a major cybersecurity breach after unauthorized third parties gained access to its Onamae cloud desktop infrastructure and began posting stolen customer data online.
• Cloud Desktop Service Compromised: The breach specifically targeted GMO’s Onamae.com Desktop Cloud platform—a specialized virtualized desktop infrastructure widely utilized by foreign exchange (FX) and financial traders for automated algorithmic trading.
• Extensive Server Impact: GMO Internet confirmed that as many as 26,739 servers may be affected by the breach, prompting the company to suspend services and order users to disconnect devices.
• Massive Extortion Attempt: Attackers issued an extortion demand of approximately 8 billion yen (around $50 million in cryptocurrency), which GMO Group Chief Executive Masatoshi Kumagai formally rejected.
• Unauthorized Financial Operations: Clients reported that stolen trading account credentials saved within automated trading software (such as MetaTrader MT4/MT5) were used illegally to execute unauthorized transactions across more than 70 brokerages, resulting in significant financial losses.
• Compensation and Remediation Commitments: GMO Internet announced it will fully reimburse customers for verified unauthorized trading losses, pay every active user 5,000 yen (approximately $32), offer six months of alternative cloud service free of charge, and request invocation of Japan’s active cyber defense mechanisms.
• Broader Chinese AI Penetration Tool Context: The breach occurred roughly one week after GMO’s internal cybersecurity division reported evidence of a Chinese AI-enabled penetration testing tool named “Artex” being deployed in cyberattacks across Japan. However, GMO noted no public link has been established between Artex and the Onamae incident.

Japan (Japan Daily News) October 27, 2026 – Japanese internet and cloud services conglomerate GMO Internet Group is investigating a severe cybersecurity breach involving its Onamae cloud desktop infrastructure after extortionists began leaking stolen customer information online. The incident, which has affected up to 26,739 servers utilized by financial and foreign exchange traders, resulted in unauthorized trades being executed across dozens of external brokerage platforms. Executive leadership at GMO formally rejected a $50 million cryptocurrency ransom demand, prompting hackers to threaten a daily release of compromised client data. In response, GMO Internet has ordered clients to disconnect their systems, pledged full compensation for verified financial losses, and notified national law enforcement and regulatory authorities.

How Did the Onamae Cloud Desktop Breach Unfold According to GMO Internet’s Official Timeline?

As reported by cybersecurity specialist Carly Page of TechCrunch, GMO Internet Group released a formal blog update detailing the timeline and technical scope of the security incident affecting its Onamae.com Desktop Cloud service.

The Onamae platform provides virtualized remote desktop environments heavily relied upon by retail and institutional financial traders to run automated trading systems and Expert Advisors (EAs) continuously.

According to the official corporate timeline disclosed by GMO Internet:

• 19 October: GMO Internet initiated an internal technical investigation after receiving inquiries from customers reporting unusual system behavior.
• 20 October: Internal security teams confirmed that unauthorized third parties had successfully breached system boundaries and installed malicious programs within individual client server environments. GMO immediately suspended new service applications and restricted access to the customer control panel.
• 21 October: At approximately 04:00 JST, GMO Internet initiated a complete, sequential shutdown of its Onamae Desktop Cloud servers across all plan tiers to isolate the breach. Simultaneously, executive leadership received an extortion message from the threat actors demanding a ransom of approximately 8 billion yen (roughly $50 million).
• 22 October: Following reports from customers that unauthorized trades were being executed on their external brokerage accounts, GMO formally consulted the Tokyo Metropolitan Police Department and engaged external digital forensics specialists.
• 23 October: GMO updated its technical service advisories, warning clients that authentication credentials—including login names and passwords for trading tools such as MetaTrader 4 (MT4) and MetaTrader 5 (MT5)—may have been viewed or extracted by malicious actors.
• 27 October: Threat actors published an online statement claiming GMO had rejected their ransom demand. The hackers posted an initial sample of stolen customer data and threatened to release additional records daily at midday unless their demands were met. GMO issued an emergency warning instructing all account holders to immediately disconnect their PCs, turn off equipment, and disconnect power supplies.

What Statement Did GMO Internet and External Observers Issue Regarding Stolen Customer Data?

As reported by Carly Page of TechCrunch, GMO Internet acknowledged via its official corporate communications that it believes the unauthorized actor has published information allegedly linked to its business operations and client base.

However, as reported by Carly Page of TechCrunch, the company stated that the full contents of the leaked data are still being verified and the total scope of the incident remains unclear.

GMO Internet advised all affected customers to reset their credentials urgently amid receiving reports of “unauthorized operations” performed directly on customer financial trading accounts. The company clarified that up to 27,000 servers (specifically 26,739 servers) may be within the affected scope of the breach.

As reported by Carly Page of TechCrunch, a spokesperson for GMO Internet did not respond to TechCrunch’s initial request for additional comment.

However, in separate public statements carried across domestic market releases, GMO Group Chief Executive Masatoshi Kumagai confirmed that the company would not comply with the hackers or pay the requested $50 million ransom. Kumagai committed to fully reimbursing customers for verified financial losses caused by fraudulent FX transactions, paying an additional ¥5,000 (approximately $32) compensation fee to all active service users, and providing an alternative cloud service platform free of charge for six months.

How Were Client Financial Trading Accounts Compromised and Exploited Across External Brokerages?

As reported by financial technology writer Sergey Khukharkin of Incrypted, the intrusion directly compromised virtualized desktop environments where traders stored unencrypted login credentials inside automated trading software.

As reported by Sergey Khukharkin of Incrypted, attackers extracted saved API keys, trading passwords, and session data for accounts hosted across more than 70 independent financial brokerages.

Using these stolen credentials, the perpetrators executed fraudulent high-volume trades without client authorization. In one instance documented by market analysts, a single client account suffered automated trading losses exceeding 2.4 million yen ($15,500) within a span of just 84 seconds. Another client reported total account losses surpassing 6 million yen.

GMO Internet emphasized that payment card numbers and banking details are not stored directly on Onamae desktop cloud servers, meaning primary credit card infrastructure remained uncompromised.

Is There a Connection to the Chinese AI Penetration Tool ‘Artex’?

As reported by Carly Page of TechCrunch, the Onamae server breach occurred approximately one week after GMO Internet’s specialized cybersecurity division publicly reported finding evidence that a Chinese AI-enabled penetration testing tool named “Artex” had been utilized in malicious cyberattacks targeting Japanese corporations.

However, as reported by Carly Page of TechCrunch, GMO Internet stated that it has not publicly established a technical connection between the Artex security tool and the breach of its Onamae cloud service.

As reported by Carly Page of TechCrunch, the Artex AI tool was also linked to severe cyberattacks targeting major financial institutions in South Korea during September 2026, according to an investigation published earlier this month by global threat intelligence firm CrowdStrike. CrowdStrike’s findings indicated that attacks utilizing Artex primarily exploited fundamental security weaknesses, such as missing multi-factor authentication (MFA) protocols and unpatched server vulnerabilities.

As reported by Reuters news agency, the Chinese developer responsible for Artex subsequently halted public software updates and transitioned the AI security utility to a closed-source model after global cybersecurity researchers linked the framework to banking intrusions across East Asia.

What Guidance Have Financial Regulators and Japanese Authorities Issued?

As reported by Carly Page of TechCrunch, regulatory bodies in Japan have heightened surveillance across the technology and financial sectors following the breach.

As reported by Carly Page of TechCrunch, a spokesperson at Japan’s Financial Services Agency (FSA) stated that the regulator issued comprehensive guidance in May urging all financial institutions to prepare for an anticipated rise in complex cybersecurity vulnerabilities.

As reported by Carly Page of TechCrunch, the FSA spokesperson added that the regulator explicitly called for stronger foundational cyber defenses, including “vulnerability management, defense-in-depth and incident preparedness,” while simultaneously encouraging commercial firms to integrate advanced AI-driven monitoring and defense tools.

Furthermore, Japan’s Financial Services Agency confirmed it has received formal damage reports from at least five major domestic foreign exchange brokerages whose clients suffered unauthorized trades linked to the Onamae server compromise.

Background of the Particular Development

GMO Internet Group is one of Japan’s most prominent internet conglomerates, managing core web infrastructure, domain registration services (including Onamae.com), cloud hosting, digital advertising, and online financial trading platforms. Its Onamae.com Desktop Cloud platform specifically caters to retail foreign exchange traders who require dedicated, high-speed Windows-based virtual environments to execute automated trading algorithms 24 hours a day without reliance on local hardware.

The compromise of virtual private servers (VPS) and remote desktop environments represents a growing vector of systemic risk for the retail trading industry. Automated trading platforms like MetaTrader MT4 and MT5 frequently store active session tokens and encrypted broker connection credentials locally on the host server to allow automated trading scripts to interact directly with brokerage execution servers. When hosting infrastructure is compromised at the root or hypervisor level, attackers can bypass external application security, capture credentials directly from system memory or configuration files, and execute market orders remotely through legitimate trading channels.

How This Development Will Affect FX Traders, Cloud Providers, and Financial Regulators

The Onamae cloud breach and subsequent extortion attempts are expected to trigger immediate operational and strategic shifts across several key sectors:

1. Retail Financial Traders and Automated Systems Users: Traders using remote desktop services for automated FX and cryptocurrency trading will face stricter mandatory security controls. Brokerages and cloud vendors are expected to enforce mandatory multi-factor authentication (MFA) for trading account access, API rate limiting, and automated alerts for login attempts originating from unauthorized IP addresses or unusual geographic locations. Traders will likely move away from storing raw trading credentials on unmanaged virtual servers.
2. Cloud Hosting Providers and Managed Service Infrastructure: Cloud vendors catering to financial clients will experience heightened regulatory scrutiny regarding tenant isolation, hypervisor security, and endpoint detection. GMO’s public petition asking Japanese authorities to apply the nation’s new active cyber defense mechanisms could set a legal precedent, prompting non-critical IT infrastructure providers to lobby for inclusion under national active defense frameworks during state-level cyber emergencies.
3. Japanese Financial Regulators and Institutional Brokerages: The Financial Services Agency (FSA) and retail FX brokerages will likely institute standardized incident-reporting mandates requiring rapid freezing of trading accounts showing automated anomalous behavior. Brokerages will be forced to strengthen backend fraud monitoring systems to detect credential-stuffing attacks and unauthorized trade execution originating from commercial hosting IP addresses.