GMO Cloud Breach Puts 26,739 Servers at Potential Risk

GMO Internet has suspended its Onamae.com Desktop Cloud service after a cyberattack potentially affected 26,739 servers and customers reported unauthorized activity in their brokerage accounts. The Japanese company said malicious software had been installed in some customer environments, raising concerns over trading credentials stored there.

The server count describes the potential scope of exposure, not a confirmed number of infected machines or compromised trading accounts. Investigators are still determining the extent of the intrusion and the financial damage, according to the company’s disclosures and Bitcoin.com News’s report.

GMO began investigating on October 19, 2026, after receiving a customer inquiry, and confirmed malicious software the following day. It suspended new applications and access to the control panel before beginning a phased shutdown of servers across all service plans at 4 a.m. Japan time on October 21.

Onamae.com Desktop Cloud allows customers to keep automated foreign-exchange trading software running without leaving their personal computers switched on. It supports tools such as MetaTrader 4 and MetaTrader 5, making credentials stored in those environments a potential route into customers’ brokerage accounts.

Customers subsequently reported transactions they had not authorized. GMO’s October 22 notice said trading account passwords and other information stored on the servers might have been obtained and misused, and the company brought in an external cybersecurity firm to investigate.

The incident also developed into an extortion attempt. GMO said a person believed to be responsible demanded money and threatened further unauthorized orders involving customer accounts at more than 70 domestic and overseas securities and foreign-exchange firms. The threats also included releasing information and carrying out ransomware attacks; they do not establish that every named category of target was compromised.

GMO rejected the demand, saying payment could not guarantee that stolen information would be deleted or further misuse prevented. The company said it submitted evidence to police and sought a criminal investigation, while working with relevant businesses to limit additional damage.

The breach highlights how an intrusion at a hosting provider can extend beyond stored files into financial activity when trading credentials are exposed. In this case, the reported harm involved unauthorized orders rather than simply the possible disclosure of personal information, making the status of brokerage sessions and account access particularly important.

GMO announced on October 24 that existing Desktop Cloud customers would receive a flat 5,000-yen payment regardless of whether they suffered financial losses. It also pledged compensation for verified losses and associated fees from unauthorized trading, alongside six months of free access to an alternative desktop platform.

Customers were instructed to change trading passwords from a device outside the affected service, disconnect sessions and review their transaction histories. GMO also urged users to enable two-factor authentication where available and report unfamiliar trades to their brokers. Service restoration remains dependent on safety checks, while investigators work to establish the intrusion’s full scope and confirm customer losses.