Threat watch / Attack
GMO Internet: attackers plant malware in an FX trading VPS service and demand about ¥8 billion
On October 20, 2026, GMO Internet found a malicious program on customer servers of Onamae.com Desktop Cloud, a VPS service used to run automated FX trading tools, and shut down every plan the next morning. Up to 26,739 servers may be affected. GMO confirms customer information was taken and that an apparent attacker demanded about ¥8 billion, which it refuses to pay. By November 12, users had filed about ¥3 billion in claims for losses on trades made in their accounts.
- Sector
- Tech & SaaS
- Way in
- Not public yet
- Product or vendor
- Onamae.com Desktop Cloud, GMO Internet
- How it happened
- GMO says a third party gained unauthorized access because the service's system had a security problem, and that a malicious program was installed on some customers' servers. It has not named the flaw or the entry point. GMO Internet Group's chief Masatoshi Kumagai said an expert from the group's own security company had flagged problems with the system earlier, and that this warning was not acted on.[1][2][6] Checked 15 Nov 2026
- What was stolen
- GMO confirms customer information was taken out of the service environment, without listing the fields. ITmedia reports that the information stored on the servers included login details for customers' trading accounts. GMO says it holds no payment data, including card numbers.[1][2][5] Checked 15 Nov 2026
- Who was impacted
- Customers of Onamae.com Desktop Cloud, mostly people running FX auto-trading tools: all plans were stopped, and by November 12, 2,943 trading accounts had claimed about ¥2.998 billion in losses. GMO says the attacker published one user's information.[3][7] Checked 15 Nov 2026
- Threat actor
- Not attributed
Timeline
- GMO receives customer inquiries about the service. [2]
- GMO confirms that a malicious program was installed on some customers' server environments. [1][2]
- All Desktop Cloud plans are stopped from 4:00 a.m. GMO publishes its first notice, saying 26,739 servers may be affected and that data stored on them may have been viewed. The same day it receives a threatening email demanding about ¥8 billion. [1][3][4]
- GMO consults the police and files first reports with the police and the competent ministry. [2][3]
- GMO confirms unauthorized access caused by a security problem in the service and that customer information was taken. It says it will not meet the attacker's demands, will compensate losses on unauthorized trades and pay ¥5,000 to every current user. [2][5]
- GMO says the apparent attacker announced it would publish customer information and launch a ransomware attack at noon, and asks customers to power off and disconnect their PCs beforehand. The attacker publishes one user's information. [3][7]
- At a press conference, Masatoshi Kumagai apologizes: "We were unable to protect our customers." He confirms the system had a security problem that an in-house expert had flagged earlier. [6]
- At its earnings briefing, GMO Internet expects direct costs of ¥3.05 billion and cuts three executives' pay. As of November 12, 2,943 accounts had claimed about ¥2.998 billion for FX losses; its cyber insurance is capped at ¥1.1 billion. [7]