Japanese technology company GMO Internet is investigating a suspected data breach affecting nearly 27,000 servers after hackers allegedly published information linked to customers of its Onamae Desktop Cloud service. The company has also received reports of unauthorized trading activity on customer accounts and a ransom demand of approximately 8 billion yen ($50 million).
The service provides virtual desktop environments used by financial traders, including those operating through securities and foreign exchange trading platforms. According to an October 27 announcement, GMO Internet confirmed that suspected attackers had published information they claimed belonged to the company and its customers, although the authenticity and extent of the exposed data remain under investigation.
GMO Internet said 26,739 servers could be affected by the incident. The company has advised customers to change their passwords and review their trading accounts after receiving reports of unauthorized transactions.
GMO Internet Suspends Cloud Service Following Cyberattack
The incident first came to the company’s attention on October 19, prompting an investigation that identified malicious software installed on certain customer servers the following day. On October 21, GMO Internet began suspending its Onamae Desktop Cloud service across all plans to prevent further unauthorized access.
The company subsequently received an email demanding approximately 8 billion yen and reported the incident to Japanese police on October 22. In its security advisory, GMO Internet warned that attackers may have accessed login credentials stored in trading applications, including MetaTrader 4 and MetaTrader 5.
On October 24, GMO Internet announced plans to compensate affected customers and provide alternative services while coordinating with government authorities. The company began collecting customer devices on October 25 and 26 to examine potential malware infections and assess the damage.
GMO Internet confirmed on October 27 that suspected attackers had published information allegedly obtained from the incident. The company said it had not confirmed a ransomware attack as of that afternoon and was continuing its investigation with cybersecurity specialists.
Separate AI-Related Cyberattacks Raise Security Concerns
The breach follows a separate disclosure by GMO Internet’s cybersecurity division concerning Artex, a Chinese-developed AI-enabled penetration testing tool reportedly used in attacks against Japanese companies. However, GMO Internet has not established any connection between Artex and the Onamae incident.
Cybersecurity company CrowdStrike also reported Artex-related attacks targeting South Korean financial institutions in September. The incidents reportedly exploited weaknesses such as insufficient multi-factor authentication, while Artex’s developer subsequently stopped public updates and made the software closed-source.
Japan’s Financial Services Agency separately told TechCrunch that it had issued cybersecurity guidance in May urging financial institutions to strengthen vulnerability management, layered defenses and incident preparedness. The regulator also encouraged financial companies to consider AI-based and other security tools to address emerging threats.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.