A cloud PC service for FX auto-trading was breached, and funds were moved out of customers' trading accounts — the GMO Internet hack

At a glance

In the GMO Internet hack, money left customers' FX trading accounts at other companies because the logins saved on their rented cloud PCs were used as they were. Attackers got into Onamae.com Desktop Cloud (お名前.com デスクトップクラウド), a remote PC service run by GMO Internet (GMOインターネット), and the trading-account IDs and passwords stored on those machines were used for trades the owners never placed. If your company keeps passwords for other services on a remote desktop or a cloud server, you may have the same structure. GMO was then hit with a demand for USD 50 million (about ¥8 billion), and it refused to pay. One weak point at a company that rents out PCs spread to its customers and to accounts at completely different companies.

When

GMO started investigating on October 19, 2026, after a customer inquiry. At 4:00 a.m. on October 21, it stopped all servers and published its first notice. A written money demand arrived the same day.

Who (company and service)

GMO Internet's Onamae.com Desktop Cloud. It is an FX auto-trading cloud PC: a rented remote Windows PC (a VPS, or virtual private server) that runs trading software 24 hours a day.

What leaked and how much

• 26,739 servers that may have been affected. The company says this is "not a confirmed count" (確認された件数ではありません).
• What went out was the information stored on the servers in general. It included trading-account logins saved in MT4/MT5 (MetaTrader 4/5, FX trading software).
• GMO says payment information, such as card data, was not kept on this service's servers.
• Neither GMO nor the Financial Services Agency (金融庁, Japan's financial regulator) has published the number of unauthorized trades or the total loss.

Why (official statements only)

GMO's official documents say only that "a security problem existed in the system of this service." They do not yet give a specific route. Press reports of GMO's November 2 press conference describe a route that started from one customer's remote desktop. I cover that separately below.

Where things stand now (as of November 4)

• All plans are still stopped, with no restart date. GMO says it will not reopen the breached platform as it is.
• GMO said it will "never comply" (永久に応じません) and refused to pay. Its reasons: paying does not guarantee the data gets deleted, and the money would fund crime.
• Compensation: ¥5,000 flat to every user, payment for actual losses from trades GMO recognizes as unauthorized, and six months of a replacement service for free. GMO said it would explain how to claim loss compensation by November 6. That explanation has not come out yet.
• On October 27, the attacker published what it claimed was customer information. According to press reports and the press conference, it covered one person.

What to check in your own company today

1. Are IDs and passwords for other services (saved in a browser or inside software) left on remote desktops, VPSs, or shared PCs?
2. Is the remote desktop's administrator account open directly to the internet? Can someone get in with a password alone?
3. After changing a password, did you also force-close the sessions that were already logged in?
4. Is two-factor authentication (a one-time code on top of the password) turned on for important accounts such as banking, securities, and cloud services?
5. Is there a clear rule for when a security problem raised by staff or outside experts must reach management?

What exactly happened?

Here is the Onamae.com Desktop Cloud breach in date order. The intrusion steps from August 2026 come from press reports of the November 2 press conference. Official documents do not confirm them yet.

• April 2024. According to press reports of the briefing, group company GMO Cybersecurity by Ierae (GMOサイバーセキュリティ byイエラエ) reported problems with this service, and GMO Internet ran emergency checks four times. The vice president admitted the response "lacked depth and speed." (Jiji Press briefing report¹)
• August to October 14, 2026. According to briefing reports, the intrusion and the spread of malware (malicious programs) happened in this period. GMO did not notice for about two and a half months and learned of it from a customer inquiry. (ITmedia briefing summary²)
• October 19. GMO started investigating after a customer inquiry.
• October 20. GMO found malicious programs on some customer servers. It stopped new sign-ups and the control panel, and went into emergency maintenance that night. (GMO notice³)
• October 21, 4:00 a.m. GMO stopped the servers on all plans one after another and issued its first report. At that point it wrote that "no misuse has been confirmed." (1st report⁴)
• October 21, 11:57 a.m. A written money demand arrived. Masatoshi Kumagai (熊谷正寿), head of the GMO Internet Group (GMOインターネットグループ), recorded this time on his blog. (Kumagai's blog⁵)
• October 22. GMO consulted the police. In its second report, it said for the first time that customers had reported "unauthorized operations by a third party in their trading accounts." (2nd report⁶) FX companies posted notices the same day.
• October 23. GMO stated again that 26,739 is the number of servers that may have been affected, not a confirmed count. It also warned that even after a password change, a third party could keep trading if an old session stayed open on the FX company's server. (3rd report⁷)
• October 24. GMO admitted there was a security problem in the system and that customer information had been taken out. It announced compensation and said it would not meet the attacker's demands. (4th report⁸)
• October 26–27. GMO said the attacker had warned it would publish information and launch ransomware (an attack that locks files and demands money) at noon on October 27. It asked customers to back up before noon, disconnect their PCs from the network, and switch them off. (7th report⁹, 8th report¹⁰)
• October 27, 12:30 p.m. GMO confirmed the attacker had published "what it claims to be information about us and our customers." (10th report¹¹)
• October 27, evening. GMO said it would never comply, and announced special consolation payments and a bounty. (12th report¹²)
• October 28. Around 4:00 a.m., the domain of the attacker's site was suspended. From noon, GMO began taking bounty tips. (13th report¹³, 14th report¹⁴)
• November 2. GMO held its first press conference, 12 days after disclosure, and announced pay cuts for four executives. (GMO filing¹⁵)

How did the attackers get in?

Official documents say two things. There was a security problem in the system, and GMO is investigating the route with a security company. The specific route is not in any official document yet. (4th report⁸)

Press reports of the November 2 press conference describe this route. (Jiji Press briefing report¹, ITmedia briefing summary²)

1. On August 5, the attacker got into one customer's remote desktop and stole an administrator account.
2. On August 17, the attacker used those administrator rights to get into GMO's management server.
3. From September 20 to October 14, the attacker spread malware to customer servers through the management server.

GMO did not disclose the detailed method, saying it could invite the same attack.

There had been a warning. On his blog, Kumagai wrote that in-house white-hat hackers (security experts who work on the defending side) had pointed out issues to fix, and that the team on the ground had worked on them. But "the depth and speed of the response were not enough," and the attacker got through the gap. (Kumagai's blog⁵) According to press reports of the briefing, that warning never reached him, and there was no numeric rule for when an issue must go to the board.

The FX companies tell the same story from their side. Each said its own systems were not confirmed to be breached. Instead, someone logged in normally with IDs and passwords that had leaked from somewhere else. GW Securities (GW証券) called the source "another company's VPS server," and Gaitame Finest (外為ファイネスト) wrote "other companies' services, etc." (GW Securities notice¹⁶, Gaitame Finest notice¹⁷)

Who was hurt, and how did money leave customers' FX trading accounts?

First, what went out. GMO's official scope is the information stored on the servers in general, including trading-account logins saved in trading software such as MT4/MT5, plus anything customers put on the servers themselves. GMO also asked customers to change every ID and password saved in their browsers. It says payment information, including card data, was not kept on the servers. (2nd report⁶, 3rd report⁷)

The only published number is "26,739 servers that may have been affected." It is not a confirmed count of intrusions or data theft. The current number of users or contracts is not in any official release. One report quotes "more than 200,000 contracts in total," but that is a running total over the years, not today's user count. (ITmedia¹⁸)

Every user of the service. The servers stopped, so every auto-trading program (an EA, or Expert Advisor, which buys and sells by preset rules) stopped too. Users were asked to change passwords, scan their whole PC, back up, and even cut the power.

Users who lost money in their FX accounts. This is how the money left. The logins taken from the cloud PCs let someone sign in to customers' accounts at FX companies. According to press reports of the briefing, GMO explained that the attacker deliberately placed trades designed to lose money. Two cases were reported. A 44-year-old man in Kanagawa lost more than ¥4 million in 2 seconds on the afternoon of October 21. Trading went on for about 2 minutes, and his loss passed ¥6 million. A 29-year-old woman in Aichi saw her balance of a little over ¥4.3 million fall to ¥6,768. (Asahi Shimbun¹⁹) No one has published the total number of victims or the total loss.

The customer whose data was posted. Reports say one person's information went up on the attacker's site. What kind of information it was has not been disclosed. (FNN²⁰)

FX companies in Japan. On October 27, Financial Services Minister Katayama (片山) said five companies had reported customer losses that appear linked to this case: GW Securities (formerly Golden Way Japan, service name FXTF), OANDA Securities (OANDA証券), Avatrade Japan (アヴァトレード・ジャパン), Gaitame Finest, and Dukascopy Japan (デューカスコピー・ジャパン). The amount was "not disclosed." (Yomiuri Shimbun²¹, Jiji Press²²)

Here is what each company said on its own site. None of the notices gives the number of affected accounts or the amount.

• GW Securities (FXTF): found damage in "multiple MT4 accounts" and restricted trading. (notice²³, follow-up²⁴)
• OANDA Securities: confirmed unauthorized logins and trades, and restricted trading on the accounts. It points customers to GMO's desk for compensation. (notice²⁵, follow-up²⁶)
• Gaitame Finest: confirmed unauthorized logins and trades on October 21 and restricted use of the accounts. (notice¹⁷)
• Dukascopy Japan: confirmed unauthorized trades in accounts of customers who used this service, and changed the passwords of suspected accounts itself. (notice²⁷, 2nd report²⁸)
• Avatrade Japan: on the list of five, but its own notices would not open during my research, so I could not check what they say.

IS6FX, an offshore FX company, said it corrected the history of trades it confirmed as unauthorized and covered the losses. It did not give an amount. (notice²⁹)

GMO itself. It carries the service shutdown, the compensation costs, and executive pay cuts. According to reports, on October 26 the share price of GMO Internet Group (9449) fell more than 15% in one day, and GMO Internet (4784) fell more than 14%. (Kyodo News³⁰)

Did GMO pay the ransom?

No. The GMO ransom demand came in a threatening email on October 21, and GMO's official report describes it as "a demand of about ¥8 billion." (13th report¹³) Kumagai's blog put it as "USD 50 million (about ¥8 billion)." (Kumagai's blog⁵)

The attacker made three threats. (4th report⁸)

1. Keep placing unauthorized orders in customer accounts at "more than 70 securities firms, FX companies and others in Japan and overseas."
2. Publish information from customer PCs that connected to this service, and attack them with ransomware.
3. Publish GMO's system and operations information.

GMO said it would never comply, because deletion of the data is not guaranteed and the money would fund crime. (12th report¹²)

When the noon deadline on October 27 passed, the attacker posted one person's information, and the site's domain was suspended early the next morning. According to reports, the Ministry of Internal Affairs and Communications (総務省, MIC, which regulates telecoms) asked four telecom industry groups in writing to block the site. (Asahi Shimbun³¹) The Tokyo Metropolitan Police Department (警視庁) is reported to be investigating on suspicion of violating the Unauthorized Computer Access Act. (Sankei Shimbun³²)

Instead of paying, GMO Internet Group put up a bounty for information that leads to the culprits, with a cap of USD 1 million for the whole program. That is GMO's money, not the attacker's demand. Tips reached 735 in total as of 6:00 p.m. on November 2. (12th report¹², 16th report³³)

On October 24, GMO also asked the government to apply active cyber defense (a system in which the state moves first against attacking servers). (4th report⁸) I found no announcement in the materials I checked that the government actually used it.

How did GMO respond?

It stopped, reported, and did not pay. All servers stopped on October 21, police were consulted on October 22, and the demand was refused.

It offered compensation beyond the three items listed above. (4th report⁸, 12th report¹²)

• The ¥5,000 goes to every current customer, whether or not they lost money, and is separate from loss compensation.
• Loss compensation covers the actual losses (trading losses, fees and so on) on trades GMO investigates and recognizes as unauthorized. Losses from market moves, profits that might have been made, and indirect damage are not covered.
• The replacement service runs on a new, separate platform. GMO will not move customers without their consent.
• Customers hit by ransomware get a new PC of the same performance.
• Customers whose information is published get a special consolation payment: ¥10,000 for basic information, ¥15,000 for financial or authentication information such as account IDs and passwords, and ¥25,000 for sensitive information. If several categories are published, the amounts are added, with a cap of ¥3 million per disclosure.

Management responsibility. Four executives will take a 20–30% pay cut for three months. GMO said it will review management responsibility again after checking everything that led up to the incident. (GMO filing¹⁵) It says it cannot yet calculate the total cost of compensation or the effect on its results. (GMO filing³⁴)

The FX companies also locked their doors tighter after the incident. GW Securities made one-time passwords mandatory for MT4/MT5 logins, and from November 2 Gaitame Finest no longer lets customers log in without security settings turned on. (GW Securities notice²⁴, Gaitame Finest notice³⁵)

Why do the numbers differ between news reports?

Coverage of this Japan cyber attack often describes the same number with a different unit, or mixes up different numbers.

• 26,739. Officially, this is the number of "servers that may have been affected," not a confirmed count. At the press conference, the president said "the customers in scope number 26,739," and some articles call it "customer data" or "virtual machines." In every version, it is not a count of confirmed intrusions.
• About ¥8 billion / USD 50 million / about ¥7.9 billion. These look like the same demand converted at different exchange rates.
• USD 1 million. This is the cap on GMO's bounty. It is not what the attacker demanded.
• ¥3 million. This is the special consolation payment's cap "per disclosure." It is not a per-person amount.
• More than 70 companies. This is the number of companies the attacker named in its threat. It is not the number of companies with confirmed damage. Five Japanese FX companies reported damage to the Financial Services Agency.
• 200,000. This is a cumulative contract count from a news report. It is not the current number of users.
• When the intrusion started. Reports on the same press conference differ: Jiji Press and ITmedia say August 5, and Bengo4.com (弁護士ドットコム) says August 20. (Bengo4.com³⁶) No official document confirms either date yet.

Was AI used in this attack?

There is no official announcement or report that AI was used in this incident. One report says Kumagai, at the press conference, gave his view that misuse of AI has greatly increased attacks. That is his personal view. It does not say AI was used in this case.

Still, what people call AI cyber attacks — attackers using AI to find weak points and even build the attack — is a capability that has already been shown.

• Anthropic published evaluation results for its AI model Claude Mythos Preview. It said the model found thousands of high-severity vulnerabilities in major operating systems and browsers, and it has not released the model to the public. (Anthropic Glasswing³⁷, Mythos Preview research³⁸)
• The security company Wiz said it used AI to find "PHP2Shell," a remote code execution flaw in the PHP engine. (Wiz blog³⁹) Amazon said it had already seen attack attempts four days before the flaw was made public. (AWS Security Blog⁴⁰)
• In the same October, GMO Cybersecurity by Ierae announced that ARTEX, an AI penetration-testing tool, was found in attack infrastructure that targeted about 20 Japanese companies. The announcement does not name any affected company, including this GMO case. (GMO Cybersecurity by Ierae announcement⁴¹)

So I think we should prepare on the assumption that people with bad intent use this kind of AI. Not because there is evidence tying it to this incident, but because the speed of finding weak points is no longer human speed.

This incident showed how far one small hole can spread. A small gap that a person waved off as "probably fine" is something AI can find in a short time. My reading is that the time we have to put off small gaps has shrunk by that much.

What does this mean for your business?

What weighs on me most in this case is that the damage did not stay inside GMO's servers. Passwords for other companies that customers had put on those servers were used on accounts at other companies. The FX companies said their own systems were not confirmed to be breached, yet their customers' money was lost in accounts at those companies.

I see this as a real example of how one small hole leads to large damage. If the press reports are right, it started from one customer's remote desktop and spread to other customers' servers. Then money was lost in real accounts at the FX companies those servers were connected to. The demand was about ¥8 billion. That is a very large amount.

Here is how it maps onto a typical company.

• A remote desktop for working from home, a VPS shared with an outside contractor, a shared office PC. If the browser on any of them has saved passwords for your bank, your cloud services, or your online store's admin page, you have the same structure. Breaking into that remote desktop hands over the keys to every service saved inside it.
• According to press reports of the briefing, the starting point was one remote desktop belonging to one customer. Once one spot is broken, it can spread to everything through a management server.
• GMO, the operator, did not notice for about two and a half months and found out from a customer inquiry (according to briefing reports). Without a way to notice something unusual, someone else will tell you first.
• GMO itself warned that sessions already open can survive a password change. Changing the password and force-closing sessions go together.
• The company admitted that experts had raised the issue, but the response lacked depth and speed. Getting a warning and having it reach a management decision are two different things.
• GMO did not pay the demand. Even so, the operator carries customer compensation, the bounty, and the share price drop, and it still cannot calculate the total cost.

I would add three thoughts of my own.

The doors customers use to reach our servers need their own check. Remote access we give to customers, the channels we use to exchange things with them. Any of these can become a way into our servers. I think we need to watch these doors with special care from now on.

If the reports are right, this route goes against common sense. If someone could move from one customer's remote desktop to the management server, then any user who wanted to could have reached the management server. For now, the route comes only from press reports of the briefing. Even so, any company that runs environments on behalf of customers should check its security policy for those environments now.

"This is probably fine" is not fine. Most big incidents start from small signs that someone ignored. According to press reports of the briefing, problems with this service were reported as early as April 2024. Kumagai wrote that the team on the ground worked on fixes, but not with enough depth or speed. Press reports of the briefing also say the warning never reached him. More than two years passed between that report and the intrusion in August 2026. In my view, whether that can be called something other than a management problem still needs checking.

What happened (based on official announcements)

• October 20, 2026: Malicious programs found on some customer servers. New sign-ups and the control panel stopped, and emergency maintenance announced. — GMO notice³
• October 21, 2026, 4:00 a.m.: Servers on all plans stopped one after another, and the 1st report published. At this point, "no misuse has been confirmed." — 1st report⁴
• October 21, 2026, 11:57 a.m.: Written money demand arrived (recorded on the group head's blog). — Kumagai's blog⁵
• October 21, 2026: Gaitame Finest confirmed unauthorized logins and trades, and restricted use of the affected accounts. — Gaitame Finest notice¹⁷
• October 22, 2026: 2nd report. GMO said customers had reported unauthorized operations by a third party in their trading accounts. 26,739 servers may have been affected (not a confirmed count). Payment information not kept on the servers. Police consulted. — 2nd report⁶
• October 22, 2026: FX companies asked customers to change passwords and issued warnings. — GW Securities¹⁶, OANDA Securities⁴², Dukascopy Japan⁴³, IS6FX⁴⁴, AI Gold Securities⁴⁵, Asahi Markets⁴⁶, AXIORY⁴⁷, Titan FX⁴⁸
• October 23, 2026: 3rd report. 26,739 is the number of servers that may have been affected, "not a confirmed count." Warned that a third party could keep trading through existing sessions even after a password change. — 3rd report⁷
• October 23, 2026: Timely disclosure. The effect on consolidated results "has not been calculated." — GMO filing⁴⁹
• October 23, 2026: Dukascopy Japan confirmed unauthorized trades in some accounts of customers who used this service. — Dukascopy Japan notice²⁷
• October 24, 2026: 4th report. "A security problem existed" in the system; customer information taken out. ¥5,000 flat consolation payment, compensation for realized losses, and six months of a free replacement service announced. The attacker's three threats disclosed, the demand refused, and the government asked to apply active cyber defense. — 4th report⁸
• October 24, 2026: 5th report. Customers asked to scan their whole PC and back up. — 5th report⁵⁰
• October 26, 2026: GW Securities named this case and reported trades "made against the customer's will." OANDA Securities confirmed unauthorized access, logins and trades. — GW Securities notice²³, OANDA Securities notice²⁵, OANDA Securities follow-up²⁶
• October 26, 2026: 6th and 7th reports. GMO said it had received a warning of data publication and a ransomware attack at 12:00 on October 27. — 6th report⁵¹, 7th report⁹
• October 27, 2026: 8th report. Customers asked to back up before noon, then disconnect their PCs from the network and switch them off. — 8th report¹⁰
• October 27, 2026: 9th report. No malware found on devices whose analysis was finished (this does not mean all are safe). New PCs to be provided to customers hit by ransomware. — 9th report⁵²
• October 27, 2026, 12:30 p.m.: Confirmed that the attacker published "what it claims to be information about us and our customers." Warned that visiting that site hands the visitor's information to the attacker. — 10th report¹¹, 11th report⁵³
• October 27, 2026: Gaitame Finest 3rd report, and follow-up notices from GW Securities and OANDA Securities. — Gaitame Finest³⁵, GW Securities²⁴, OANDA Securities⁵⁴
• October 27, 2026: 12th report. "Never comply." Special consolation payments (cap of ¥3 million per disclosure) and a bounty (cap of USD 1 million) announced. — 12th report¹²
• October 28, 2026, around 4:00 a.m.: Attacker site's domain suspended. The timeline in this report records the "demand of about ¥8 billion" in the October 21 threatening email. — 13th report¹³
• October 28, 2026: Bounty tips accepted from 12:00. No traces of malware or ransomware found on collected devices. — 14th report¹⁴
• October 28, 2026: Timely disclosure. Total compensation and related amounts cannot be calculated. No impact confirmed on other group services. — GMO filing³⁴
• October 28, 2026: Dukascopy Japan 2nd report. — Dukascopy Japan notice²⁸
• October 29, 2026: IS6FX said it corrected the history of trades confirmed as unauthorized and covered the losses. — IS6FX notice²⁹
• October 29, 2026: 16th report. Tip counts to be published at 6:00 p.m. on weekdays. — 16th report³³
• October 30, 2026: Consolation payment procedures and replacement service details began going directly to contract holders. — GMO notice⁵⁵
• November 2, 2026: Pay cuts for four executives disclosed. — GMO filing¹⁵
• November 2, 2026, 6:00 p.m.: Bounty tips reached 735 in total. — 16th report, update³³
• November 6, 2026 (planned): How to claim loss compensation, required documents, claim period, and payment timing to be announced. Not yet published as of November 4. — 4th report⁸

Companies that disclosed damage and what leaked

Companies that announced no impact: AI Gold Securities (AIゴールド証券), which said that, based on GMO's report as of October 23, its customers' trading-account information was not among the information that may have been viewed, and no unauthorized trades were confirmed — 16402⁴⁵, 16438⁵⁶; and GMO Click Securities (GMOクリック証券), which said this did not happen on its own service and no unauthorized operations were confirmed — Oct 23⁵⁷, Oct 26⁵⁸.

Companies that only issued warnings (that login information may have been viewed, and a request to change passwords): Asahi Markets (あさひマーケッツ) (notice⁴⁶), AXIORY (notice⁴⁷), Titan FX (notice⁴⁸).

As of November 4, 2026. Each company's notices may change after this date.