GMO Internet Group says attackers broke into its Onamae.com Desktop Cloud, a Windows hosting service used for automated foreign-exchange trading, stole customer information and demanded roughly 8 billion yen (about $50 million). The company has refused to pay, and new reporting shows attackers have already posted material they describe as customer data.
What happened
On October 20, GMO confirmed that an unauthorized third party had installed malicious programs in some customer server environments. Starting at 4 a.m. Japan time on October 21, it began shutting down servers on all Desktop Cloud plans. It counts 26,739 servers as potentially affected, a figure that is not a confirmed count of compromised machines.
The same day, GMO received an extortion email. According to The Hacker News, GMO confirmed on October 24 that unauthorized access and theft of customer information had occurred. The attackers set a deadline of noon on October 27, Japan time, and GMO said at 12:30 p.m. that alleged company and customer information had appeared online. As of 1:55 p.m. it had not confirmed any ransomware attack, and the posted material was still being checked. The Hacker News reports GMO shut down the attackers’ site and its mirrors around 4 a.m. on October 28.
Who is affected
Desktop Cloud customers are mostly traders who run MetaTrader platforms on always-on remote Windows machines. Customers began reporting unrecognized trades on October 21, and OANDA Japan said a third party had logged in to some customer accounts using login credentials believed to have leaked from GMO’s servers. OANDA Japan restricted trading on accounts that may have been affected and told clients their login IDs and passwords may have been exposed. GMO says payment-card data is not affected because it is stored on separate infrastructure.
The attackers have also threatened to keep manipulating customer accounts at more than 70 securities and FX firms and to launch ransomware on customer PCs. GMO says that, on the customer machines it had finished checking, it found no malware, including ransomware. That does not prove every machine is clean.
What to do
- Change your broker account and trading-platform passwords from a device that is not tied to Desktop Cloud, and end active sessions. GMO and OANDA Japan both give this advice.
- Turn on two-factor authentication for brokerage and MT4/MT5 logins where it is offered, as OANDA Japan recommends.
- Review trade history and balances, and report anything unrecognized to your broker right away.
- Rotate any password reused elsewhere or saved in a browser on the affected servers.
- Ignore messages from anyone claiming to be the attackers or offering paid data recovery. GMO says it will never ask for passwords or authentication codes.
- Our analysis: if you run any hosted trading or admin desktop, assume secrets stored on it were exposed until the provider says otherwise.
What we still do not know
GMO has not said how the attackers got in. The attackers claimed a shared administrator account and default drive visibility between machines, but GMO has not confirmed this. It is also unclear how many customers’ data was actually stolen, whether the leaked files are authentic in full, and when or whether the service will return. GMO says the breached systems will not be restarted as they are and is offering a replacement Windows desktop service, free for six months. It has also announced compensation payments and a bounty of up to $1 million for information leading to an arrest.
Sources: The Hacker News (Oct. 28, 2026); Cyber Security News (Oct. 28, 2026); BleepingComputer (Oct. 21, 2026); FX News Group (Oct. 22, 2026).
Leave a Reply