GMO Internet Group chief executive Masatoshi Kumagai apologised on 2 November 2026 at the group's first press conference on the breach of Onamae.com Desktop Cloud (お名前.com デスクトップクラウド), a Windows VPS service that traders use to run automated FX trading around the clock. "It is a fact that this service's system had a security problem," he said. He also admitted that security specialists inside the group (GMO Cybersecurity by Ierae) had flagged problems with the system in 2024, and that the company "could not use" that warning in running the service.
How the attack unfolded, as GMO now describes it: vice president Hiroshi Yamashita said the attacker entered a customer VPS on 5 August through the service's remote desktop, stole an administrator account, reached a management server on 17 August and distributed malware to customer VPSs between 20 September and 14 October. Bengo4.com reported the first intrusion as 20 August instead, and Kumagai said the entry route has not yet been confirmed by forensics. GMO began investigating after a customer inquiry on 19 October, found malicious programs on 20 October and shut down all plans on 21 October. Up to 26,739 servers may be affected — GMO stresses this is the number that could be affected, not a confirmed count.
Damage so far: GMO confirmed on 24 October that customer data had been taken. Trading-account logins stored on the VPSs were misused for unauthorised trades; Japan's financial services minister said on 27 October that five FX firms had reported customer losses. The attacker demanded about 8 billion yen (about $50 million), threatened ransomware against customers' PCs and posted data it claims belongs to customers. GMO says it will not pay. As of 28 October it had found no malware or encryption on the customer PCs it collected for analysis. GMO has not said how many accounts were hit or how much money was lost.
Compensation: full compensation for realised losses from unauthorised trades (application details by 6 November), a flat 5,000 yen to every current customer, up to 3 million yen where a customer's data is confirmed published, a replacement PC for any ransomware victim and six months of a free alternative service. Four executives take pay cuts; Kumagai's is 30% for three months. GMO also offers a bounty of up to US$1 million and had received about 700 tips by the press conference.
Who did it is not confirmed. Kyodo reported a possible North Korean link; Kumagai said GMO had shared its analysis with the authorities but could not name a country during the investigation. Separately, GMO's security unit has said the Chinese AI pentest tool Artex was used against Japanese companies, but has not linked it to this breach.
