GMO Internet Breach: Hackers Posted Customer Data After the Company Refused a ¥8 Billion Ransom

In brief

• GMO Internet says attackers published data allegedly linked to Onamae cloud-desktop customers after it refused a ¥8 billion ransom demand. What traders should do.
• GMO Internet confirmed on October 27, 2026 that people believed to be the attackers had published information they claim relates to the company and its customers, hours after the company had asked customers to power off their PCs ahead of a midday announcement.
• The breach began with unauthorized access to Onamae Desktop Cloud, a service that rents virtual desktops to financial traders. GMO shut the service down on October 21, received a threatening email demanding about ¥8 billion (roughly $50 million), and reported the incident to Japanese police on October 22.
• GMO says it will not comply with the attackers’ demands, that no ransomware attack had been confirmed as of October 27, and that the published material is still being verified — it warns the material may contain information inconsistent with the facts.
• What makes this breach different from a standard data leak is what lived on those desktops: traders ran automated strategies there, with access to brokerage accounts. GMO has received reports of unauthorized operations on customer trading accounts, and has promised compensation for losses from unauthorized transactions.

A week that ended with a publication

The incident moved in public steps, each one announced by GMO itself in a numbered report — ten by October 27. On October 21, GMO suspended Onamae Desktop Cloud and published its first report on the unauthorized access. The same day it received a threatening email demanding approximately ¥8 billion. On October 22 it consulted the police and published a second report. On October 24 it announced sympathy payments and compensation for losses, plus alternative services for affected customers, and asked relevant government agencies to apply active cyber defense measures. On October 25 it asked customers across Japan to cooperate with a device investigation, and on October 26 it began analyzing the devices it had taken into custody.

October 27 was the escalation. At 09:58 JST, GMO published an interim progress report on the device analysis and asked customers to power off their PCs in preparation for an announcement at noon. At 11:59 it published a further status update. Then, at 12:30, it confirmed that persons believed to be the attackers had published what they claim to be information about the company and its customers. The tenth report, published at 13:55 JST, set out GMO’s position: the published content is being verified, individual customers whose information is confirmed in it will be contacted directly, and the company is preparing legal measures against anyone who spreads the material with a high degree of malice.

GMO’s own warning about the published material deserves emphasis, because it cuts against the usual instinct to go and look. The company says the information of people who access the leak site has been obtained by the attackers, and it asks customers not to access or spread the material. Checking whether your data is in a leak is normally reasonable advice; in this case, the company that owns the data says visiting the site exposes the visitor. That warning is itself a signal about what kind of attackers these are: they are not only publishing, they are harvesting the audience.

The ransom GMO refused

GMO’s refusal is stated plainly in the tenth report: “We will not comply with the attackers’ demands. This is because complying with their demands does not guarantee that the information they obtained will be deleted or that its unauthorized use will be prevented.” The company says it has consulted the police and other relevant authorities and is proceeding in cooperation with them.

That stance has a cost the company is already paying. The publication on October 27 is the predictable consequence of refusing a ransom demand, and GMO’s response to it — sympathy payments, loss compensation, device collection, legal threats against spreaders — is the expensive alternative to paying. It is also the stance that makes the company’s later claims checkable: a company that paid would have every reason to minimize; a company that refused and is compensating losses has staked money on its version of events.

One clarification in the tenth report matters for how this incident is categorized. As of 13:55 on October 27, GMO said no ransomware attack had been confirmed, and it remained on alert. The incident involves a ransom demand and a data publication, which is the extortion half of the ransomware playbook, but GMO has not confirmed that ransomware was deployed on its systems or on customer devices. The device analysis now under way — GMO’s white-hat team examining customer PCs for malware, including ransomware — is what will settle that question. Until it does, calling this a ransomware attack overstates what GMO has confirmed, in the same way calling it “just” a data leak understates the ransom demand behind it. Readers tracking this story should watch for the device-analysis results the way they would watch for a forensic report: they are the next facts that can change the category.

Why a trading desktop is a special target

Onamae Desktop Cloud rents virtual desktops, and its customers are disproportionately financial traders who need a machine that stays on around the clock. Automated trading strategies — robots that watch markets and place orders without a human at the keyboard — run on those desktops, and to do that they hold access to brokerage accounts. That is what turns this breach from an identity problem into a money problem.

GMO has said it received reports of unauthorized operations performed on customer trading accounts, and it advised customers to reset their passwords. It has also committed to compensation for losses from unauthorized transactions, separate from the flat ¥5,000 sympathy payment announced in its fourth report. A company does not promise transaction-loss compensation for a breach that only exposed names and email addresses. The commitment itself tells readers something about the scope, even while GMO says the full extent of the incident remains unclear.

The comparison that clarifies the risk is the ordinary cloud account. If an attacker compromises your email, they can read messages and reset passwords. If an attacker compromises a desktop that trades for you, they can act in markets as you — placing orders, moving positions, draining through loss-making trades rather than withdrawals. The defense is also different: changing a password is not enough if a session, an API key, or a stored brokerage login on that desktop is still live. That is why the advice section below goes beyond passwords, and why GMO’s device-collection effort — taking custody of customers’ own PCs across Japan for analysis — is not theater. The company is trying to answer a question its customers cannot answer alone: is there something on my machine that is still working for the attacker?

The scale GMO has described is large. TechCrunch, reporting GMO’s statements, said 27,000 servers may be affected by the breach. That figure should be treated as the company’s current estimate, not a counted total — GMO itself says verification is ongoing, and the precise count has been reported differently elsewhere. What is not in doubt is that the service was big enough, and its users’ trading activity continuous enough, for a shutdown on October 21 to still be the status a week later, with alternative services being arranged rather than the original service restored.

The response that stands out

Three parts of GMO’s response are unusual enough to note, because they show what a company does when the standard breach playbook does not fit.

First, the device collection. GMO asked customers across Japan to hand over their own devices, sent staff nationwide to take custody of them, and has its white-hat team analyzing them in turn to confirm the extent of the damage, including whether malware has actually been planted. Companies normally analyze their own servers after a breach. Collecting customers’ personal machines is a recognition that in this incident the customers’ endpoints are part of the crime scene, not just the victims’ property.

Second, the power-off request. On the morning of October 27, GMO asked customers to power off their PCs in preparation for the noon announcement — a blunt, disruptive instruction that only makes sense if the company believed live machines could still be reached or observed by the attackers. It is the kind of request a company makes when it would rather be accused of overreacting than explain later why it did not act.

Third, the money. The flat ¥5,000 sympathy payment is modest, but it sits alongside deliberations on additional payments for customers whose information is confirmed in the published material, and compensation for losses from unauthorized transactions. The structure — a small payment to everyone affected, larger redress tied to confirmed harm — is the shape of a company that expects the confirmed-harm list to grow as verification proceeds.

GMO has also received offers of cooperation from security companies including Trend Micro and from AI companies, and says it is coordinating the details of their help. Japan’s Financial Services Agency, meanwhile, told TechCrunch it issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities, calling for stronger basic defenses including vulnerability management, defense-in-depth, and incident preparedness.

What traders should do now

If you used Onamae Desktop Cloud, do not wait for an individual notice to take the basic steps — GMO says it will contact customers whose information is confirmed in the published material, but verification is still under way.

First, reset your GMO and Onamae passwords, and then go further than passwords: revoke and reissue any brokerage API keys, tokens, or saved sessions that lived on the rented desktop, and review your brokerage trade history for orders you did not place. A password change does not kill a live session or a stored key, and this is an incident where the attacker may have held exactly those.

Second, follow GMO’s own device advice: run a full antivirus scan on your own devices, back up your data, and if GMO asks for your device as part of its investigation, cooperate — the analysis is how the company determines whether malware is present. Do not open links or files in emails or SMS messages about the incident; GMO says it will never ask for your password or authentication code, and that any “recover your losses” offer arriving by message is a scam to ignore.

Third, do not visit the leak site to check for your data. GMO says the attackers have obtained the information of people who accessed it. If you need to know whether you are affected, wait for GMO’s individual contact, or ask through GMO’s official contact form or its 24-hour phone line — channels the company itself lists in its tenth report.

Fourth, watch your brokerage statements for the next several weeks, not just the next few days. Unauthorized operations may surface as trades you did not make, positions you did not open, or small test transactions that precede larger ones. If anything unfamiliar appears, report it to your broker and to GMO immediately, and keep records — GMO’s loss-compensation commitment makes documentation valuable in a way it would not be after a breach that only exposed contact details.

The Artex connection that is not one

One thread in the coverage needs explicit correction, because it is easy to get wrong. About a week before the Onamae breach, GMO’s cybersecurity unit separately reported finding evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan. Artex was also used against financial institutions in South Korea in September, according to a CrowdStrike report earlier this month — the subject of AuTechWire’s recent coverage of the South Korean arrests. GMO said it has not publicly established a connection between Artex and the Onamae breach.

That distinction matters. Two stories about Japanese targets in the same month are not one story, and treating them as one would mislead readers about both. The South Korean case involved arrests and a specific tool’s use against financial institutions; the Onamae case involves a ransom demand, a publication, and a cloud-desktop service, with the tool behind it still undisclosed. Readers who follow both should keep them separate until GMO or investigators say otherwise. Related reading: South Korea Arrests Seven in Its First Large-Scale AI-Assisted Hacking Case, Capcom ID Breach: 11.7 Million Accounts Exposed — What Affected Users Should Do, Sony So-net Breach: 2.58 Million Records Exposed, What to Do, Microsoft 365 Token Replay Bypassed MFA at 79 Firms, SafePay Ransomware Hit 600+ Organizations — and Hid Behind the VPN You Trust.

What to watch next

Four updates would materially change this story. The first is verification: what the published material actually contains, and whether GMO confirms customer information in it — which triggers individual notifications and the additional payments now under deliberation. The second is the device analysis: whether malware, including ransomware, is found on customer machines, which would settle the ransomware question GMO left open on October 27. The third is the loss picture: how many unauthorized transactions are confirmed, and what GMO’s compensation totals look like once claims are assessed. The fourth is the government response: whether the active cyber defense measures GMO requested on October 24 produce anything concrete, and whether the Financial Services Agency’s May guidance hardens into requirements after an incident of this size.

Until one of those arrives, the correct status of this breach is: service suspended since October 21, ransom demanded and refused, data published October 27 and unverified, no ransomware confirmed, losses from unauthorized transactions acknowledged in principle but unquantified. Any coverage that sounds more certain than that is overstating what GMO has said — and in a story where the company itself warns that the published material may contain falsehoods, that discipline is not pedantry. It is the point.

Update: the Eleventh Report (October 27, 14:55 JST)

About an hour after confirming the publication, GMO published an eleventh report
that is mostly about containment rather than new facts. It asks readers not to
reproduce, repost, or link to the published material, warns that phishing emails
and fraud are already riding on the incident, and repeats the commitment that
customers whose information is confirmed in the published material will be
contacted individually. It adds no verification of what the published material
contains, no device-analysis results, and no restoration date for Onamae — the
four open questions in “What to watch next” below remain open.

Sources

• TechCrunch — “Japan internet giant GMO says hackers posted stolen customer data” (Oct 27, 2026; Onamae cloud desktops for traders; 27,000 servers may be affected; password resets after unauthorized operations on trading accounts; ¥8 billion ransom demand; FSA May guidance)
• GMO Internet — “[Important] Current Response to Unauthorized Access to Onamae.com Desktop Cloud (Tenth Report)” (Oct 27, 2026, 13:55 JST; publication confirmed 12:30 Oct 27; verification ongoing; no ransomware confirmed; do-not-access warning; sympathy payment deliberations; device analysis; Trend Micro cooperation; refusal to comply; full timeline Oct 21–27)
• KuCoin flash — “Japan’s GMO Investigates Data Leak Affecting 27,000 Servers” (CoinDesk reporting) (Oct 27, 2026; timeline corroboration: Oct 21 shutdown, Oct 22 police report, Oct 24 compensation + alternative services, Oct 25–26 device collection, Oct 27 publication)
• GMO Internet — “[Important] Current Response to Unauthorized Access to Onamae.com Desktop Cloud (Eleventh Report)” (Oct 27, 2026, 14:55 JST; anti-spread request; phishing warning; individual-contact commitment if customer information is confirmed; no new verification, device findings, or restoration date)

Last verified: October 28, 2026.