GMO Internet has confirmed that attackers breached its Onamae.com Desktop Cloud service, stole customer data and then used trading credentials stored on the rented servers to place unauthorized orders at brokerages. The Japanese hosting giant also says someone believed to be the attacker demanded money, and that it will not pay.
The service rents Windows cloud desktops that traders typically use to run automated FX trading software around the clock. GMO says 26,739 servers across all plans could have been affected, though it stresses that figure is the number of servers at risk and not a confirmed count of compromised machines. It has not disclosed how many customers were hit.
A week-long timeline from inquiry to shutdown
According to GMO’s first public report, the company began investigating on Oct 19 after a customer inquiry. By Oct 20 it had confirmed that a third party installed a malicious program on some customers’ server environments, and it suspended new sign-ups and the control panel.
On Oct 21 at 4:00 AM JST (3:00 PM ET on Oct 20), GMO began shutting down servers on every plan. At that point it said data on the servers “may have been viewed,” with no confirmed leak or misuse. That changed within a day. Customers began reporting trading activity they did not recognize, and by Oct 22 GMO acknowledged in its second report that trading login credentials stored on the servers may have been taken and misused. It alerted the brokers involved and consulted police the same day.
GMO’s fourth report, published Oct 24, went further. The company acknowledged that the service had security vulnerabilities, that its environment was accessed without authorization and that customer information was taken outside the company. It has not named an entry point or a CVE.
The extortion demand GMO says it received
GMO says the apparent attacker threatened to keep manipulating customers’ trading accounts at more than 70 securities and FX firms in Japan and abroad, publish information about the service and customer PCs connected to it, launch ransomware attacks, and publish details of GMO’s own systems. GMO did not disclose a ransom amount. It says it has refused to pay and handed all communications to police cybercrime units.
Separately, an unverified statement attributed to the attacker reportedly demands US$1 million, with a deadline of noon JST on Oct 27 (11:00 PM ET on Oct 26). The same statement allegedly claims that administrator rights were shared across servers, that remote desktop settings let attackers reach customers’ own computers, and that servers belonging to cancelled customers were retained. It also allegedly includes file-collection logs from 6 customer PCs that reportedly show thousands of copy operations, including browser saved-login databases and tax and pay documents. None of this has been verified, and no named threat actor or group has claimed the attack.
Losses and regulator response
Individual losses are already surfacing in the Japanese press. One customer reportedly lost more than 4 million yen in about 2 seconds on Oct 21, with total losses above 6 million yen after trades continued for nearly 2 minutes. Users on social media have reported losses ranging from 550,000 yen to 6 million yen, though those claims are unverified.
Japan’s Financial Services Agency reportedly notified FX firms on Oct 22 through the Financial Futures Association of Japan, urging them to tell customers to change passwords and check for unrecognized trades. Two GMO group brokers, GMO Click Securities and GMO Gaika, issued advisories about unauthorized trades at multiple FX firms, and both say their own accounts showed no unauthorized activity. No victim brokerages have been named.
What GMO is offering customers
- A flat 5,000 yen goodwill payment to every current user, with details due by email by Oct 30.
- Reimbursement of realized losses and fees from unauthorized trades, minus any broker refunds. Market-driven losses, lost profits and indirect damages are excluded.
- A move to an alternative Windows desktop service on separate cloud infrastructure, free for 6 months and only with the customer’s consent. The affected service will not restart on its current infrastructure.
- Instructions on how to apply for loss coverage, due by Nov 6.
The parent company, GMO Internet Group, said in a stock exchange disclosure that it cannot yet calculate the financial impact. GMO has also publicly asked the Japanese government to treat the incident as the first invocation of the country’s new Active Cyber Defense law.
Why this breach hits differently
Most hosting breaches end at stolen data. Here, the stolen data was a set of live keys to financial accounts, and attackers allegedly used them while GMO was still working out what happened. That turns a data theft into real-time financial fraud, and it explains why GMO moved to cut the service off from brokers and exchanges rather than waiting for forensic answers.
GMO’s group CEO wrote in a blog post on Oct 25 that the company’s own internal security researchers had flagged problems with this service before the attack, and that fixes were underway but not deep or fast enough. For organizations tracking similar pressure campaigns, see BreachNews’ explainer on what data extortion is and how Kraken refused an extortion demand.
Customers of the service should treat any trading credentials, browser-saved passwords and documents stored on the affected servers as compromised, change passwords for every trading and financial account used from them, and review recent order history for unrecognized trades.
