GMO Internet said on October 24, 2026 that attackers broke into Onamae.com Desktop Cloud, a server service that currency traders rent to run automated trading. The intruders saw login data stored on those servers, including investors' broker passwords. Trading accounts at more than 70 securities and FX firms may have been misused, the Yomiuri Shimbun reports.
The company will pay every user ¥5,000, about $32, whether or not they lost money. It also asked the Japanese government to use its new "active cyber defense" powers against the attackers.
What was breached
Onamae.com Desktop Cloud rents out virtual servers, remote computers that run around the clock. FX traders, who trade foreign currencies, use them to run trading programs that place orders automatically. Those programs need the trader's broker login, so the passwords sit on the server.
More than 20,000 people use the service, according to the Yomiuri. Jiji Press puts the number of servers that may be affected at 26,739. The two outlets count different things, users and servers, so the figures do not conflict.
According to the Yomiuri, third parties viewed the stored login data and then made unauthorized trades.
How it unfolded
| Date (2026) | Event |
|---|---|
| October 20 | An unauthorized third-party program is found on some servers |
| October 21, 4 a.m. | GMO halts the servers |
| October 22 | GMO consults the Tokyo Metropolitan Police |
| October 23 | GMO Internet Group files its first notice to investors |
| October 24 | GMO confirms information was taken, announces payments and asks the government to act |
The timeline comes from the Yomiuri and the Asahi Shimbun.
Losses and extortion
Customers have lost real money. The Asahi spoke to a 29-year-old woman in Aichi who lost about ¥4.3 million and a 32-year-old man in Saitama who lost about ¥550,000. A hacker group claims losses in the tens of billions of yen, the Yomiuri reports. That claim is unverified, and GMO has given no total.
Someone believed to be the attacker demanded money and threatened to publish company and customer data. GMO refused. "We will not comply with the attacker's demands," the company said, according to Jiji. Paying would not guarantee the data is deleted or stop it being misused, GMO explained, according to the Asahi.
On the afternoon of October 24, a suspected attacker posted online that it would hit customers' own PCs with ransomware. GMO told users to back up their data and run virus scans, the Asahi reports.
What GMO is offering
GMO will pay a flat ¥5,000 to every user of the service. It will also cover losses and fees from trades confirmed as unauthorized, but not indirect damages. Users will get application details by email by November 6. Anyone who wants it gets a replacement cloud service free for six months.
"We take seriously the fact that we were unable to protect customers' information and assets," GMO said, as quoted by the Asahi.
A first test for Japan's new cyber law
Japan's active cyber defense law took effect on October 1, 2026. It lets police and the Self-Defense Forces enter attackers' servers to shut down an attack, the Yomiuri explains. GMO urgently asked the government to apply it. Its statement said private companies acting alone struggle to stop the theft of citizens' assets, Briefs reports.
The government has not said whether it will act. A Yomiuri headline cites an unnamed government official saying the system is not activated on request.
The breach adds to a hard month for Japanese companies. Japan's government told firms and banks to tighten security on October 9 after more than 20 reported attacks.
What this means for developers
If you used Onamae.com Desktop Cloud, change every broker password stored on it now, from a clean device. Turn on two-factor login at each broker and check your trade history for orders you did not place.
Anyone running trading bots or other automation on a rented server should treat that server as a target. Where a broker offers API keys, use them instead of your main password. Limit each key to trading only, with no withdrawals, and lock it to known IP addresses.
Keep secrets out of plain files. A password manager or a secrets store with encryption at rest makes stolen disk contents far less useful.
Watch Tokyo's answer to GMO. Whether the government uses its new powers here will show how far Japan will go to defend private companies from attacks.
This article was first published on Tech AI Wire.
Also available in
Deutsch · 日本語 · Français · Español · Português
Related on Tech AI Wire
Sources
- GMO, active defense requested: unauthorized access attack, government asked; FX trading financial damage compensated - Jiji Press
- GMO, hit by unauthorized access, urgently asks government to apply active cyber defense - Yomiuri Shimbun (via Yahoo! News Japan)
- GMO asks government for active cyber defense after information leak from unauthorized access - Asahi Shimbun (via Yahoo! News Japan)
- GMO confirms information leak, condolence payment to all users - Kyodo News (via livedoor News)
- GMO seeks government-led active cyber defense after FX trading breach - Briefs
Top comments (0)