# GMO Internet Group Permanently Shuts Cloud Service After Hack, Urges Japan to Use New Cyber Defense Powers

> A major Japanese cloud provider has permanently suspended its Desktop Cloud service after hackers compromised up to 26,739 servers, demanded payment, and threatened further unauthorized trading, prompting a call for the government to use its new active cyber defense capabilities.

By PrimaryBrief newsroom · Published 2026-10-25T05:40:33.666257Z
Canonical: https://primarybrief.com/article/gmo-internet-group-permanently-shuts-cloud-service-after-hack-urges-japan-to-use-new-cyber-defense-powers-fe886815

GMO Internet Group has permanently shut down its Onamae.com Desktop Cloud service, potentially affecting up to 26,739 servers, after hackers demanded payment and threatened to continue unauthorized orders through accounts at more than 70 securities and FX firms in Japan and abroad [1][7][9][15]. The company confirmed unauthorized access and malicious program installations on customer servers, leading to reports of unauthorized trading activity from its clients [1][12].

The incident has created significant disruption for customers who relied on the service for continuous remote workloads, particularly automated foreign exchange (FX) trading using platforms like MetaTrader 4 and 5 [2][6]. The potential compromise of trading credentials has prompted warnings from FX firms, and GMO's request marks a potential first application of Japan's newly enacted active cyber defense powers [7][15].

## What the records show

GMO Internet Group confirmed unauthorized access to its Onamae.com Desktop Cloud service and the installation of malicious programs in customer server environments [1][4]. Up to 26,739 servers were identified as potentially affected, though this figure represents the possible scope, not a confirmed count of infected systems [1][5][11]. Data on these servers, including login information for trading accounts and tools like MT4 and MT5, may have been compromised, leading to customer reports of unauthorized trading operations [1][6][7][12]. GMO stated it does not store payment information, such as credit card details, on the affected servers [1][4][6][8]. The attackers demanded payment, threatening continued unauthorized orders at over 70 firms, data leaks, and a ransomware attack, which GMO has refused to pay [7][15].

## The timeline

GMO began investigating customer inquiries on October 19, 2026, confirming malicious software installations by October 20 [13][1]. The company started shutting down all Onamae Desktop Cloud servers on October 21 to prevent further damage [1][3][4]. On October 22, OANDA Japan alerted customers to potential MT4/MT5 credential compromise and temporarily halted withdrawals [7]. GMO confirmed customer reports of unauthorized trading operations and advised password changes [1][12]. GMO consulted police that day [1][13]. By October 24, GMO publicly disclosed the attackers' demands, its refusal to pay, and its request for Japan's government to use its active cyber defense powers [7][15]. Japan's new cyber defense powers became effective on October 1, 2026 [7].

## What changed and for whom

The Onamae Desktop Cloud service is permanently shut down, with GMO planning a security overhaul rather than restarting the existing platform [15]. This decision impacts customers who relied on the service for remote operations, particularly automated FX trading [2][6]. GMO urged customers to change trading account passwords and disconnect active sessions [1][4][6][8]. The company will compensate users for realized losses and fees from fraudulent trades, and all current users will receive a flat ¥5,000 goodwill payment [15]. GMO has asked police to open a criminal investigation and requested major exchanges to block access from the service [7]. Its call for the Japanese government to employ its new active cyber defense powers would mark the first use of these capabilities [7][15].

## What GMO has said publicly

GMO Internet Group acknowledged the unauthorized access and malicious program installation, noting that up to 26,739 servers were potentially affected, but not confirmed as infected [1][5][11]. The company confirmed that trading account login information and other data might have been illegally obtained [1][12]. GMO stated it does not store customer payment information on the affected servers [1][4][6][8]. The company advised customers to change passwords and disconnect sessions [1][12]. GMO publicly refused the attackers' demands, citing no guarantee of data deletion or misuse prevention [7]. It is cooperating with police and an external cybersecurity firm [1][7][14]. GMO announced compensation for losses and a goodwill payment, and formally requested the Japanese government to use its active cyber defense measures [7][15].

## What we could not confirm

PrimaryBrief could not confirm the precise number of actually compromised servers, as 26,739 refers to the potential scope [1][5][11]. The specific malware used, the initial method of access, and whether attackers copied data elsewhere or which specific files were targeted for exfiltration remain undisclosed [5].

## Evidence cited
1. Onamae Desktop Cloud hack: GMO Internet reports unauthorized trading, police consultation, customer actions (rescanada.com) — https://rescanada.com/
2. Onamae Cloud Malware Attack Forces GMO Internet to Suspend Service (cyberupdates365.com) — https://cyberupdates365.com/
3. Japan's GMO Internet Shuts Down Cloud Service After Hackers Plant Malware, 26,739 Servers at Risk (cyberpress.org) — https://cyberpress.org/
4. Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected (www.bleepingcomputer.com) — https://www.bleepingcomputer.com/news/security/japans-onamae-desktop-cloud-hacked-up-to-27-000-servers-affected/
5. Japan's Onamae Desktop Cloud breached, 26,739 servers at risk from malware (cybersecuritynews.com) — https://cybersecuritynews.com/
6. Japanese VPS provider Onamae Desktop Cloud halts service after hackers install malware on customer servers (teiss.co.uk) — https://teiss.co.uk/
7. GMO asks Japan to use new cyber defence powers after hack (thenextweb.com) — https://thenextweb.com/
8. Onamae Desktop Cloud hack affects up to 27,000 servers in Japan (scmagazine.com) — https://scmagazine.com/
9. GMO Halts All 'Onamae.com Desktop Cloud' Plans, Potentially Impacting Around 27,000 Servers (ascii.jp) — https://ascii.jp/
10. Japan's Onamae Desktop Cloud Hacked, Up to 26,739 Servers Affected (ledgi.tech) — https://ledgi.tech/
11. Onamae Desktop Cloud hacked: What happened and what it means for customers (dropletnevertrust.com) — https://dropletnevertrust.com/
12. Follow-up Report Regarding Unauthorized Access to "Onamae.com Desktop Cloud" and Request for Customer Cooperation (internet.gmo) — https://internet.gmo/
13. GMO Internet’s cloud service hacked, customer inquiries on Oct 19, police consulted on Oct 22 (financefeeds.com) — https://financefeeds.com/
14. GMO Internet’s cloud service hacked, customer inquiries on Oct 19, police consulted on Oct 22 (gate.com) — https://gate.com/
15. GMO Internet to Pay ¥5,000 Compensation to All Users and Cover Losses After Unauthorized Access (biggo.com) — https://biggo.com/
16. GMO Hit by Cyberattack; Customers Report Unauthorized Transactions (yomiuri.co.jp) — https://yomiuri.co.jp/
17. GMO Internet Hit by Cyberattack; Asks Gov't to Implement Active Cyber Defense (ground.news) — https://ground.news/
18. Onamae Desktop Cloud hack: GMO Internet reports unauthorized trading, police consultation, customer actions (tokyobrief.com) — https://tokyobrief.com/
19. GMO Internet confirms Onamae Desktop Cloud breach, up to 26,739 servers affected (mallory.ai) — https://mallory.ai/
20. Japan authorizes offensive cyber operations starting Oct. 1 | brief | SC Media (scworld.com) — https://scworld.com/
21. OANDA Japan Holds Withdrawals After Hack at Server Host Used by FX Traders (tradingview.com) — https://tradingview.com/
22. GMO to Reimburse Forex Users for Intrusion-Linked Trading Losses (tokenpost.com) — https://tokenpost.com/
23. OANDA Japan Delays Withdrawals After Cloud Service Breach (fastbull.com) — https://fastbull.com/
24. OANDA Japan Holds Withdrawals After Hack at Server Host Used by FX Traders (forexfactory.com) — https://forexfactory.com/
25. OANDA Japan warns of unauthorized access to Onamae.com Desktop Cloud - FX News Group (fxnewsgroup.com) — https://fxnewsgroup.com/
26. GMO server breach exposes forex traders' broker logins (leaprate.com) — https://leaprate.com/
27. GMO Internet Hit by Cyberattack; Asks Gov't to Implement Active Cyber Defense (nippon.com) — https://nippon.com/
28. GMO Internet asks government to take active cyberdefense measures | The Japan Times (japantimes.co.jp) — https://japantimes.co.jp/
29. Japan's New Active Cyber Defense Law to Allow Offensive Cyber Operations from October 2026 (hi-network.com) — https://hi-network.com/
30. Japan's Active Cyber Defense: Capabilities, Limitations, and Strategic Implications (recordedfuture.com) — https://recordedfuture.com/
31. Japan's Active Cyber Defense: Key Provisions Take Effect October 1, 2026 (daily.dev) — https://daily.dev/
32. Japan's New Active Cyber Defense Framework Takes Effect (hlc.com) — https://hlc.com/
33. Japan's Active Cyber Defense Act: What it is and how to prepare (brain-d.jp) — https://brain-d.jp/
34. Onamae.com Desktop Cloud operators shut down services after malware found in customer servers, potentially impacting up to 26,739 servers. (sec-news.ai) — https://sec-news.ai/
35. Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected (bleepingcomputer.com) — https://bleepingcomputer.com/news/security/japans-onamae-desktop-cloud-hacked-up-to-27-000-servers-affected/