Key Takeaways
- GMO Internet identified a cloud security breach potentially affecting 26,739 trading servers.
- Hackers threatened GMO customers’ accounts at more than 70 brokerages unless their demands were met.
- GMO Internet rejected the extortion demand and offered compensation for verified unauthorized trading losses.
Attackers Target Always-On Trading Servers
GMO Internet discovered the intrusion after a customer inquiry on Oct. 19, 2026. By Oct. 20, investigators had confirmed malicious software inside customer server environments operated by Onamae.com Desktop Cloud, a service designed to keep automated foreign exchange (FX) trading programs running around the clock.
The platform supports trading software such as Metatrader 4 and Metatrader 5, allowing customers to execute strategies without leaving their personal computers running. Unfortunately, that convenience also placed valuable brokerage credentials inside an environment that attackers had penetrated.
GMO began shutting down servers at 4 a.m. Japan time on Oct. 21, eventually taking the entire service offline. The company subsequently identified a security flaw in its own systems that permitted unauthorized access and the removal of customer information.
Hackers Threaten Accounts at More Than 70 Brokerages
The attackers allegedly obtained trading credentials and used compromised accounts to execute unauthorized transactions. Reports described customers losing substantial sums within minutes, including one account of approximately 2.4 million yen disappearing through repeated trades in roughly 84 seconds.
The extortion demand took an especially aggressive turn. Attackers threatened further unauthorized activity affecting customer accounts at more than 70 domestic and international securities and FX brokerages unless GMO paid. They also threatened to expose stolen information and launch additional ransomware attacks.
GMO refused, arguing that payment offered no guarantee stolen information would disappear or that further attacks would stop. The company consulted police and engaged outside cybersecurity specialists. Importantly, the 26,739 figure represents potentially exposed servers, not confirmed infections. The total financial damage remains undetermined.
GMO’s Cryptocurrency History
GMO Internet Group has deep roots in the cryptocurrency industry, having entered the sector during bitcoin’s explosive growth in 2017. The Japanese conglomerate launched GMO Coin in May of that year, later securing regulatory registration and expanding into ethereum, bitcoin cash, litecoin and XRP trading. That September, GMO unveiled ambitious bitcoin mining plans involving renewable-powered facilities in Northern Europe, proprietary 7-nanometer mining chips and cloud mining services. GMO even paid employees in BTC in 2017.
The venture ultimately proved expensive, with the company recording approximately 35.5 billion yen in restructuring-related losses in 2018 as falling cryptocurrency prices battered mining profitability. Despite that setback, GMO continued building its digital asset business through GMO Coin, adding lending, staking, margin trading and token offerings. The group also explored stablecoins, blockchain ventures and investments in emerging cryptocurrency businesses, establishing a substantial presence in Japan’s digital asset economy.
The Japanese Heavyweight Responds to the Attack
Regarding the latest cyberattack, GMO announced on Oct. 24 that every existing Desktop Cloud customer would receive a flat 5,000-yen payment, regardless of whether they suffered financial losses. The company also pledged to compensate verified losses and associated fees from unauthorized trading, while offering affected customers six months of free access to an alternative desktop platform.
GMO rejected the attackers’ extortion demands, engaged outside cybersecurity specialists and submitted evidence to Japanese police. Group founder Masatoshi Kumagai also requested government intervention under Japan’s active cyber defense framework, seeking assistance in neutralizing the threat. The compromised infrastructure remains offline as investigators work to determine the full extent of the intrusion, the number of affected accounts and the financial damage inflicted on customers.
