GMO Internet Group Permanently Shuts Cloud Service After Hack, Urges Japan to Use New Cyber Defense Powers

GMO Internet Group has permanently shut down its Onamae.com Desktop Cloud service, potentially affecting up to 26,739 servers, after hackers demanded payment and threatened to continue unauthorized orders through accounts at more than 70 securities and FX firms in Japan and abroad[1][7][9][15]. The company confirmed unauthorized access and malicious program installations on customer servers, leading to reports of unauthorized trading activity from its clients[1][12].

The incident has created significant disruption for customers who relied on the service for continuous remote workloads, particularly automated foreign exchange (FX) trading using platforms like MetaTrader 4 and 5[2][6]. The potential compromise of trading credentials has prompted warnings from FX firms, and GMO's request marks a potential first application of Japan's newly enacted active cyber defense powers[7][15].

What the records show

GMO Internet Group confirmed unauthorized access to its Onamae.com Desktop Cloud service and the installation of malicious programs in customer server environments[1][4]. Up to 26,739 servers were identified as potentially affected, though this figure represents the possible scope, not a confirmed count of infected systems[1][5][11]. Data on these servers, including login information for trading accounts and tools like MT4 and MT5, may have been compromised, leading to customer reports of unauthorized trading operations[1][6][7][12]. GMO stated it does not store payment information, such as credit card details, on the affected servers[1][4][6][8]. The attackers demanded payment, threatening continued unauthorized orders at over 70 firms, data leaks, and a ransomware attack, which GMO has refused to pay[7][15].

The timeline

GMO began investigating customer inquiries on October 19, 2026, confirming malicious software installations by October 20[13][1]. The company started shutting down all Onamae Desktop Cloud servers on October 21 to prevent further damage[1][3][4]. On October 22, OANDA Japan alerted customers to potential MT4/MT5 credential compromise and temporarily halted withdrawals[7]. GMO confirmed customer reports of unauthorized trading operations and advised password changes[1][12]. GMO consulted police that day[1][13]. By October 24, GMO publicly disclosed the attackers' demands, its refusal to pay, and its request for Japan's government to use its active cyber defense powers[7][15]. Japan's new cyber defense powers became effective on October 1, 2026[7].

What changed and for whom

The Onamae Desktop Cloud service is permanently shut down, with GMO planning a security overhaul rather than restarting the existing platform[15]. This decision impacts customers who relied on the service for remote operations, particularly automated FX trading[2][6]. GMO urged customers to change trading account passwords and disconnect active sessions[1][4][6][8]. The company will compensate users for realized losses and fees from fraudulent trades, and all current users will receive a flat ¥5,000 goodwill payment[15]. GMO has asked police to open a criminal investigation and requested major exchanges to block access from the service[7]. Its call for the Japanese government to employ its new active cyber defense powers would mark the first use of these capabilities[7][15].

What GMO has said publicly

GMO Internet Group acknowledged the unauthorized access and malicious program installation, noting that up to 26,739 servers were potentially affected, but not confirmed as infected[1][5][11]. The company confirmed that trading account login information and other data might have been illegally obtained[1][12]. GMO stated it does not store customer payment information on the affected servers[1][4][6][8]. The company advised customers to change passwords and disconnect sessions[1][12]. GMO publicly refused the attackers' demands, citing no guarantee of data deletion or misuse prevention[7]. It is cooperating with police and an external cybersecurity firm[1][7][14]. GMO announced compensation for losses and a goodwill payment, and formally requested the Japanese government to use its active cyber defense measures[7][15].

What we could not confirm

PrimaryBrief could not confirm the precise number of actually compromised servers, as 26,739 refers to the potential scope[1][5][11]. The specific malware used, the initial method of access, and whether attackers copied data elsewhere or which specific files were targeted for exfiltration remain undisclosed[5].