GMO Internet has taken its Onamae.com Desktop Cloud service offline after hackers gained access to customer environments, potentially exposing 26,739 servers and allegedly using stolen brokerage credentials to place unauthorised foreign exchange trades.
The intrusion was discovered after a customer inquiry on 19 October 2026. Investigators confirmed on 20 October that malicious software had been installed within customer server environments operated by Onamae.com Desktop Cloud, which allows automated FX trading programmes to run continuously.
The service supports platforms including Metatrader 4 and Metatrader 5, enabling customers to operate trading strategies without keeping their own computers switched on. That convenience also meant brokerage login details were stored in an environment breached by the attackers.
GMO began shutting down servers at 04:00 Japan time on 21 October, eventually taking the entire service offline. It later identified a vulnerability in its own systems that had allowed unauthorised access and the removal of customer information.
The attackers allegedly used compromised trading accounts to carry out unauthorised transactions. Reports said some customers lost substantial sums within minutes, including one account from which approximately 2.4 million yen was taken through repeated trades in about 84 seconds.
The extortion threat extended beyond the affected service. The attackers warned they would carry out further transactions against customer accounts held with more than 70 domestic and international securities and FX brokerages unless GMO paid them. They also threatened to publish stolen information and conduct additional ransomware attacks.
GMO refused to pay, saying there was no guarantee that payment would lead to the deletion of stolen information or prevent further attacks. The company contacted police and brought in external cybersecurity specialists.
The figure of 26,739 refers to servers that may have been exposed, rather than systems confirmed to have been infected. The total financial impact remains unknown.
GMO’s digital assets business
GMO Internet Group entered the cryptocurrency industry during bitcoin’s rapid growth in 2017, launching GMO Coin in May of that year. It later obtained regulatory registration and expanded into ethereum, bitcoin cash, litecoin and XRP trading.
In September 2017, the group announced plans for bitcoin mining facilities powered by renewable energy in Northern Europe, as well as proprietary 7-nanometer mining chips and cloud mining services. It also paid employees in BTC that year.
The project resulted in approximately 35.5 billion yen in restructuring-related losses in 2018 after falling cryptocurrency prices reduced mining profitability. GMO nevertheless continued to develop GMO Coin, adding lending, staking, margin trading and token offerings, while also exploring stablecoins, blockchain projects and investments in emerging cryptocurrency businesses.
On 24 October, GMO said every existing Desktop Cloud customer would receive a flat 5,000-yen payment, regardless of whether they had suffered financial losses. It also promised to cover verified losses and related fees from unauthorised trading, and to provide six months of free access to an alternative desktop platform.
GMO has submitted evidence to Japanese police. Group founder Masatoshi Kumagai has also sought government assistance under Japan’s active cyber defence framework to help neutralise the threat.
The compromised infrastructure remains offline while investigators establish the full extent of the breach, the number of affected accounts and the financial damage caused.
