Hackers Infiltrate GMO Internet's Cloud Trading Network in Extortion Plot

As cyber threats targeting automated financial trading infrastructures mount in Japan, the cloud trading infrastructure of GMO Internet, one of the country's leading technology groups, was shaken by a large-scale cyberattack. A vulnerability detected in the company's Onamae.com Desktop Cloud service exposed 26,739 servers to unauthorized access risks. Attackers reportedly infiltrated clients' brokerage accounts, executed unauthorized transactions, and subsequently attempted to extort payment from the company.

The incident came to light after GMO Internet management launched an investigation following a client inquiry on October 19, 2026. Following technical investigations, the presence of malware on Onamae.com Desktop Cloud servers, which enable automated foreign exchange trading software such as MetaTrader 4 and MetaTrader 5 to run continuously, was confirmed on October 20. The vulnerability in the platform, which offers the convenience of executing strategies without keeping personal computers running, enabled attackers to breach the system and seize clients' trading credentials. On October 21 at 04:00 a.m. Japan time, the company began shutting down servers, taking the entire service offline.

How did the GMO Internet attack affect user accounts?

Infiltrating the system, the attackers executed unauthorized trades in client accounts using the compromised trading permissions. In the incident, which resulted in severe financial losses in a short period, one client's balance of approximately 2.4 million yen reportedly evaporated within roughly 84 seconds through consecutive transactions. In their extortion demands against GMO Internet management, the attackers threatened to escalate unauthorized transactions across accounts at more than 70 domestic and international securities and foreign exchange brokerages, leak stolen data, and launch new ransomware attacks if their demands were not met.

What compensation did the company offer clients following the attack?

Firmly rejecting the extortion demands, GMO Internet emphasized that paying a ransom would not guarantee the deletion of stolen information or the cessation of attacks. Having contacted law enforcement authorities and collaborating with external cybersecurity experts, the company announced on October 24 that a fixed payment of 5,000 yen would be made to all current Desktop Cloud users, regardless of whether they suffered direct financial damage. Stating that verified losses and associated transaction fees would be compensated, the company also granted affected clients free access to an alternative desktop platform for 6 months. Meanwhile, group founder Masatoshi Kumagai requested government intervention under Japan's active cyber defense framework to neutralize the threat.

Entering the cryptocurrency sector during the 2017 boom, GMO Internet Group launched the GMO Coin platform in May of that year and, following regulatory approval, incorporated Bitcoin, Ethereum, Bitcoin Cash, Litecoin, and XRP trading. In September 2017, the group announced Bitcoin mining plans with renewable energy-powered facilities in Northern Europe, proprietary 7-nanometer mining chips, and cloud mining initiatives, and paid salaries to its employees in Bitcoin. Restructuring in 2018 after falling cryptocurrency prices hit profitability, the company recorded a loss of approximately 35.5 billion yen. Despite this, continuing its growth in the digital asset market, the group maintained its presence in Japan's digital asset economy through lending, staking, and leveraged trading.

Authorities reported that the figure of 26,739 represents the number of servers potentially at risk rather than confirmed infections, and that the total financial damage has not yet been clarified. As the compromised infrastructure remains offline, the investigation to determine the number of affected accounts and the final financial impact continues.

This content is for information purposes only and does not constitute investment advice.