GMO cloud desktop breach hits FX traders, attacker wants $50m

Japanese internet provider GMO Internet has told customers that attackers broke into Onamae.com Desktop Cloud, a hosted Windows desktop service the company markets as a good environment for running foreign exchange trading applications. According to The Register, which reported the incident on 27 October 2026, GMO admitted the previous week that "a third party had installed malicious programs in the server environments of some customers". The company has since said its systems "had security vulnerabilities, that its environment was accessed without authorization, and that customer information was taken outside the Company".

The practical effect for users is severe. GMO said some customers have reported "transactions in their trading accounts that they do not recognize", and warned that third parties had probably seen passwords for trading services. It told users to change those passwords immediately, and to do so from a device they do not use for trading. The company also contacted major trading services and asked them to forcibly terminate all active sessions, watch for unauthorised transactions, and block trade requests originating from Onamae.com Desktop Cloud.

GMO has warned that 26,739 virtual desktop servers may have been hit, and that users' own personal devices may be at risk. It added that some trading apps keep sessions alive even after a password change, and advised customers to disconnect all active sessions themselves or ask their broker's support desk to do it.

The company said it has "received a demand for money from a person believed to be the attacker", who threatened to publish information about GMO and its customers if refused. The sum demanded is $50 million. GMO said it will not pay, because "complying would not guarantee that the obtained information is deleted or that its misuse is prevented".

GMO is offering affected users a ¥5,000 (about $32) condolence payment and has promised to cover trading losses caused by the attack. In a blog post, GMO chief executive Masatoshi Kumagai described the payment as "a token of our initial sincerity" and said the group would provide a free alternative environment for six months, overhaul its system infrastructure and investigate the cause with outside experts.

Kumagai also acknowledged the company had been warned about the service. "Our in-house white-hat hackers had previously pointed out areas for improvement to the team," he wrote, adding that GMO moved cautiously because of concerns about service availability and other priorities, and that its "response lacked sufficient depth and speed, allowing the attackers to exploit the vulnerability".

He tied the incident to the spread of automated attack tooling, arguing that "the ease with which open weight AI models can be combined and spread into countless attack tools" has lowered the skill needed to mount attacks. He said GMO Group's cybersecurity operation "has confirmed that the source of an unauthorized access attack targeting approximately 20 Japanese companies was the misuse of 'ARTEX,' an autonomous AI penetration testing tool originally intended for defense".

Kumagai said GMO had submitted a proposal to the Japanese government to "apply proactive cyber defense", while stating the company was "by no means trying to shift the blame". Investigations into the breach continue.