GMO Internet discovered a security breach in its Onamae.com Desktop Cloud service after a customer inquiry on October 19, 2026. The platform, which keeps automated foreign exchange and cryptocurrency trading programs running continuously, potentially exposed as many as 26,739 servers to compromise.
Investigators confirmed malicious software had penetrated customer server environments by October 20. The cloud service hosts trading software including Metatrader 4 and Metatrader 5, allowing users to execute trading strategies without leaving personal computers running. GMO began shutting down servers on October 21 and subsequently identified a security flaw in its systems that permitted unauthorized access and customer information removal.
Unauthorized Trades and Extortion Threats
Attackers allegedly obtained trading credentials and used compromised accounts to execute unauthorized transactions. Reports described customers losing substantial sums rapidly, including one account where approximately 2.4 million yen disappeared through repeated trades in roughly 84 seconds.
The attackers demanded extortion payment and threatened further unauthorized activity affecting customer accounts at more than 70 domestic and international securities and foreign exchange brokerages. They also threatened to expose stolen information and launch additional ransomware attacks.
GMO refused the demands, arguing that payment offered no guarantee stolen information would disappear or that further attacks would stop. The company consulted police and engaged outside cybersecurity specialists.
Company Response and Compensation
On October 24, GMO announced compensation measures for affected customers. The company pledged a flat 5,000-yen payment to every existing Desktop Cloud customer, regardless of whether they suffered financial losses. GMO also committed to compensating verified losses and associated fees from unauthorized trading, while offering affected customers six months of free access to an alternative desktop platform.
GMO founder Masatoshi Kumagai requested government intervention under Japan's active cyber defense framework. The compromised infrastructure remains offline as investigators work to determine the full extent of the intrusion, the number of affected accounts, and the financial damage inflicted on customers.
GMO's History in Digital Assets
GMO Internet Group entered the cryptocurrency industry during bitcoin's growth in 2017, launching GMO Coin that May. The Japanese conglomerate expanded into ethereum, bitcoin cash, litecoin, and XRP trading after securing regulatory registration. The company announced bitcoin mining plans in September 2017 involving renewable-powered facilities in Northern Europe and proprietary 7-nanometer mining chips.
The venture proved costly, with GMO recording approximately 35.5 billion yen in restructuring-related losses in 2018 as falling cryptocurrency prices affected mining profitability. Despite that setback, GMO continued building its digital asset business through GMO Coin, adding lending, staking, margin trading, and token offerings.
