Key Points
ใปAccording to GMO Internet’s notices of October 23 and 24, 2026, unauthorized access to its Onamae.com Desktop Cloud service, which many FX traders use to run automated trading software around the clock, led to unfamiliar trades in some customers’ accounts, and all servers have been offline since October 21.
ใปGMO confirmed that customer information was taken out of its systems, and said that someone believed to be the attacker demanded money and threatened to publish the information. GMO refused the demand and reported it to the police. The entry route and the culprit are still under investigation.
ใปBecause attackers can cause losses just by placing trades, without withdrawing any money, the case puts pressure on companies that hold customers’ login details, on how they respond to warnings, and on how much they explain.
GMO’s Hosting Service Breached, Customer Accounts Traded Without Permission
According to GMO Internet’s October 23, 2026 notice, the company began investigating on October 19 after customers of Onamae.com Desktop Cloud contacted it. On October 20 it confirmed that malicious programs had been placed on some customers’ servers, and from the early hours of October 21 it shut down all servers in stages. GMO says 26,739 servers may have been affected, and states that this is not the number of servers where intrusion or data theft has actually been confirmed.
On October 23, 2026, the FX broker AvaTrade Japan announced that it had confirmed unauthorized logins and unauthorized trades in the accounts of some customers who use the service. It said it had found no sign that information leaked from its own systems.
According to GMO’s October 24, 2026 notice, the company confirmed that customer information was taken out of its systems. It said that someone believed to be the attacker demanded money and threatened to publish the information if GMO did not comply, and that GMO did not comply and reported the matter to the police. The same day, GMO announced a plan to compensate customers for losses from unauthorized trades and asked the government to apply Japan’s active cyber defense framework to the case.
In an October 26, 2026 addendum to his blog post of the previous day, GMO Group Representative Masatoshi Kumagai said the demand document received at 11:57 a.m. on October 21 asked for 50 million US dollars (about 8 billion yen), and that GMO has not complied and has paid nothing. Chief Cabinet Secretary Minoru Kihara declined to comment on the individual case at a press conference the same day.
Related Articles
Why a Rented Windows Desktop Stores Trading Account Logins
A VPS, or virtual private server, is a computer environment rented inside a data center and operated over the internet. According to ITmedia’s October 23, 2026 explanation, Onamae.com Desktop Cloud is a VPS that provides a virtual Windows desktop. FX traders have used it to run automated trading programs, known as EAs (expert advisors), around the clock without leaving a home computer switched on.
That convenience means the rented environment often stores the login details for brokerage and FX accounts. According to GMO’s October 23, 2026 notice, malicious programs were placed in some customers’ environments, and the stored account login information may have been taken and used by a third party. The entry route and the culprit are under investigation, and the check includes whether customers’ own computers were affected.
GMO has not said whether the account operations were carried out on the rented desktop’s screen or from elsewhere with stolen login details. What is confirmed is that AvaTrade Japan also saw unauthorized logins and trades on its side. With the servers stopped, automated trading has stopped too, and customers have had to manage their open positions by hand.
What does the extortion look like, and why do authorities advise against paying?
What GMO has disclosed is a demand for money and a threat to publish information. The information taken was customer information, so a company that holds customers’ data was put under pressure with that data. Losses from trades alone, without any withdrawal of funds, add to that pressure. A similar pattern of pulling customers into pressure on a company appeared abroad: the British retailer ASOS said that on October 6, 2026 a fake notification went out to some customers through its app saying that data would be leaked unless the company engaged.
This resembles a common ransomware tactic. Ransomware is malicious software that encrypts data and demands payment to restore it. According to Japan’s National Police Agency, double extortion, in which attackers also steal the data and threaten to publish it unless paid, now accounts for many cases. What GMO has confirmed is the removal of information and the threat to publish it. It has not said that any data was encrypted.
Authorities elsewhere advise against paying in general. The National Police Agency says payment could fund criminal groups and does not guarantee that data will be restored. The FBI and CISA, the US Cybersecurity and Infrastructure Security Agency, said in their November 2023 #StopRansomware advisory that payment does not guarantee recovery and may encourage attackers to target other organizations. The UK’s National Crime Agency said in February 2024 that, in a ransomware case it investigated, data of victims who had paid was still on the criminals’ systems, so payment does not guarantee deletion. These are general reasons given by public agencies. GMO has not said why it refused.
What did GMO say about earlier warnings and compensation?
In an October 25, 2026 blog post, GMO Group Representative Masatoshi Kumagai said that the group’s in-house white-hat hackers (security specialists who test defenses) had told the field teams beforehand about issues to fix, and that the depth and speed of the response were not sufficient. Which issues were raised, and how they were handled, has not been disclosed.
Compensation comes in two separate parts, according to GMO’s October 24, 2026 notice. One is a 5,000 yen goodwill payment to all current customers regardless of whether they suffered losses. The other covers losses and fees from unauthorized trades that GMO recognizes as caused by this access. October 30 and November 6 are the dates by which GMO plans to explain how to receive each, and they are not application deadlines. The affected servers will not be restored, and GMO is guiding customers to a rebuilt replacement service.
How does it compare with attacks abroad?
Around the same time, overseas attacks that spread through outside services were being analyzed. They involved ARTEX, an AI-driven penetration-testing tool (software that probes systems for weaknesses). CrowdStrike described ARTEX as open-source and developed in China, and Microsoft said it can use any AI model. According to Kumagai’s blog, GMO’s group security firm confirmed ARTEX being used at the source of attacks aimed at about 20 Japanese companies.
According to Microsoft’s October 21, 2026 report, it assessed that a group it calls Storm-0940, which it describes as aligned with the Chinese state, used ARTEX to attempt sign-ins to more than 2,250 Microsoft 365 tenants (organization-level environments), and that the majority of the targeting was not successful.
Microsoft linked the US software vendor ConnectWise’s cloud backup breach to that group. In ConnectWise’s case, an attacker abused the connection permissions (access that customers had allowed into their own environments) tied to the service.
According to CrowdStrike’s October 7, 2026 report, an attacker not tied to any known group used ARTEX with DeepSeek against South Korean financial institutions.
There is no confirmation that the GMO intrusion was carried out by the same actor or with the same methods as these cases, and GMO has not said whether AI was used in its own intrusion.
What the GMO Case Puts in Question
Why do the burdens fall on the company that holds customers’ logins?
Desktop Cloud customers kept the credentials for their trading accounts in an environment GMO prepared. When one company’s defenses fail, the accounts of many customers running on it can be hit together.
Convenient services ask customers to hand over login details or operating permissions to the provider. The ConnectWise case abroad has the same structure, since customers had allowed the service access to their own cloud environments. The party that holds such access has to protect not only its own systems but the credentials that lead to its customers’ property and data.
How much did the gap between warning and fix matter?
GMO has acknowledged that its response to issues pointed out in advance was not deep or fast enough, and Kumagai wrote that the attackers exploited that gap.
On the attackers’ side, automation is advancing. According to Microsoft’s October 21, 2026 report, there were several cases where the time from first targeting to privileged access was under three hours. Against opponents that keep trying automatically, the weakest defenses are found first, and the time available to postpone a known issue is short.
Does blaming strong attackers answer customers’ questions?
Kumagai argued in his blog that the abuse of AI is making attacks easier, and called for public-private cooperation. Some online voices criticize the company for shifting from its own shortcomings to a request to the state.
Attackers being capable is a fact, but customers want to know where the defenses broke, what was taken, and how it will be fixed. GMO says the entry route and the scope of impact are still being investigated. How much of the results it shares, including what the flagged issues were and how they were handled, may shape how far customers’ trust returns.
How far should the state go to help a private company?
Active cyber defense, which took effect on October 1, 2026, lets police and the Self-Defense Forces disable attacker-controlled servers when the state or critical infrastructure is attacked, according to ITmedia’s October 1, 2026 report. GMO has acknowledged that it is not a legally designated operator and argues that the damage reaches citizens’ assets, so it asked for the framework to be applied.
The case for the state stepping in is that a single private company cannot reach the attacker’s side. When customers’ assets have actually been operated and a company is being extorted, investigation and action against the source need the state’s powers.
Kihara said that whether to take measures is judged against the legal requirements whether or not a request is made, and declined to comment on the case, explaining that doing so could reveal the government’s response to attackers. Widening the scope would also bring the state into more private networks, and some argue that companies should first harden their own defenses. How much of a company’s request the state should take on when the company was slow to act on warnings is an open question for a framework that has only just started.
Japanese Reactions to the GMO Hack
This section covers two posts on X from individual users, selected from posts about the GMO breach. They are reactions on X, not a measure of Japanese public opinion. Any numbers in the posts are the posters’ own claims, and the quotes below are our translations. The second post was written on October 23, before GMO announced its compensation plan on October 24, 2026.
An FX trader who goes by “ruma” posted on October 22 about the shock of the news.
ใใใฏๆใใใ…๐ฐ
— ruma (@FxRumasan) October 22, 2026
ไปๅใฏFXๅใVPSใธใฎไธๆญฃใขใฏใปในใชใฎใงใไธปใซEAไฝฟใฃใฆใไบบใ่ขซๅฎณใซ้ญใฃใๆใใ ใใฉใๆจไปใฎๅใ็ใซ่ฃ้ๅขใๅ จใๅฎๅฟใงใใ็ถๆณใใใชใใ
ใใใใใฏใ็ธๅ ดใใ่ณ้ใๅฎใใ ใใงใชใใๅฃๅบงใใฎใใฎใๅฎใใชใใใฐใใใชใๆไปฃใธ…ใโฆ https://t.co/d4zgd7ET8j
This is far too scary… This time it was unauthorized access to a VPS for FX, so it mostly hit people who were using EAs, but given how things are going lately, even traders who trade manually can’t feel safe at all. From now on it’s an era where we have to protect not only our funds from the market but the accounts themselves… (translated)
The embedded text of the post is cut off at that point, so the quote covers only the part we could verify. The post is written as a trader’s personal worry. It reads the case as a warning that account security is now part of managing trading risk, including for people who were not directly affected.
A user named “Babachan” posted on October 23, before the compensation announcement.
DMMใฏ็ด482ๅๅใฎๆตๅบใซๅฏพใใ้กงๅฎข่ณ็ฃใฎๅ จ้ก่ฃๅใๆใกๅบใใฆใพใใ
— ใฐใฐใกใใ (@Shoetsu_Baba) October 23, 2026
GMOใไปๅใฎ่ขซๅฎณใใฆใผใถใผ่ฒ ๆ ใง็ตใใใใใชใใ้กงๅฎขใซๅใๅใ่ฆๆใ่ถณใใชใใจๆใใพใใ
ใใใใๆใซใฉใ่ฒฌไปปใๅใใใงใไผๆฅญใฎไฟก้ ผใปใฒใใฆใฏๆชๆฅใๆฑบใพใใพใใใ https://t.co/Si3YpM9WuR
DMM has announced full compensation of customer assets for its roughly 48.2 billion yen outflow. If GMO ends up leaving the damage to its users, I feel it lacks the resolve to face its customers. How a company takes responsibility at times like this decides its trust and its future. (translated)
The poster asks for a company to take responsibility for customers’ losses and cites DMM’s earlier case as a comparison. The 48.2 billion yen figure and the description of DMM’s compensation are the poster’s own claims, which we did not check. GMO’s compensation plan came the next day.
These two posts show a worry about the safety of accounts and a call for the company to take responsibility. They are a small selection from X, not a picture of how Japan as a whole sees the case.
The Responsibility of Protecting What Customers Entrust
In the GMO case, an intrusion into a rented desktop reached customers’ trading accounts. Then the company was extorted with the customer information taken out of its systems.
It is not a story only for FX traders. In shopping apps and business services, customers also leave login details and personal data with the provider. If the holder is breached, customers’ damage can become leverage against the company.
What GMO is being asked is why it could not act in time on the issues pointed out, how much of customers’ losses it will cover, and what it will explain. As attacks become more automated, the weight of protecting what customers entrust applies to every business that holds it.
Frequently Asked Questions
What happened to GMO’s Onamae.com Desktop Cloud?
According to GMO Internet’s October 23 and 24, 2026 notices, malicious programs were found on some customers’ servers on October 20, all servers were stopped from the early hours of October 21, and customer information was confirmed to have been taken out. FX broker AvaTrade Japan confirmed unauthorized logins and trades in some customers’ accounts.
Was data encrypted, and was a ransom demanded?
GMO’s October 24, 2026 notice says someone believed to be the attacker demanded money and threatened to publish the information, and that GMO refused and told the police. In an October 26, 2026 blog addendum, GMO Group Representative Masatoshi Kumagai said the demand, made in a document received on October 21, was for 50 million US dollars (about 8 billion yen), and that GMO has paid nothing. GMO has not said that any data was encrypted, so it is not confirmed to be the encrypting type of ransomware attack.
Is compensation available, and is there a deadline?
Yes, in two parts, according to GMO’s October 24, 2026 notice: a 5,000 yen goodwill payment to all current customers, and compensation for losses and fees from unauthorized trades that GMO recognizes as caused by this access. October 30 and November 6 are planned guidance dates, not application deadlines.
Is the GMO attack linked to ARTEX or the ConnectWise breach?
No link has been confirmed. The entry route and the culprit are under investigation, and GMO has not said whether AI was used. The ARTEX cases abroad, including Microsoft’s analysis of the ConnectWise breach, are comparisons only.
How did Japanese social media react to the GMO hack?
The two individual posts on X that we selected expressed worry that account security is now part of trading risk, and a call for GMO to take responsibility for customers’ losses. They are a small selection from X, not a measure of Japanese public opinion.
Sekahan on YouTube
We publish video summaries of articles like this one, along with short clips built around Japanese reactions.
Reference Links
- Apology and Notice Regarding Unauthorized Access to Onamae.com Desktop Cloud, Report 3 | Onamae.com
- Cyberattack on the Onamae.com Desktop Cloud Service, Report 4 | GMO Internet Group
- Why I Proposed Active Cyber Defense: Let’s Protect Japan Together, Public and Private | Masatoshi Kumagai blog
- Notice on Unauthorized Access to Onamae.com Desktop Cloud and Request to Change Passwords | AvaTrade Japan
- Chief Cabinet Secretary Kihara Declines to Comment on GMO’s Request for Active Cyber Defense | KSB (ANN)
- Active Cyber Defense Takes Effect | ITmedia
- Latest ASOS Security Incident Update | ASOS
- AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise | Microsoft Security Blog
- Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance | CrowdStrike
- Trust Center Advisories | ConnectWise
- Ransomware Damage Prevention Measures | National Police Agency of Japan
- #StopRansomware: Advisory AA23-325A | CISA
- NCA leads international investigation targeting world’s most harmful ransomware group | UK National Crime Agency
