Cyberattack on GMO Internet: hackers gained access to clients' trading accounts

Japanese company GMO Internet confirmed a large-scale cyberattack on the cloud service Onamae com Desktop Cloud – virtual desktops used, among other things, for automated trading on the Forex currency market. The attackers gained unauthorized access to the infrastructure and stole user data. Some clients reported unknown operations on their trading accounts and financial losses.

According to The Japan Times, up to 26,739 servers were at risk. This refers to potentially affected infrastructure, not the confirmed number of compromised systems. The investigation began on October 19 following client reports. The next day, specialists discovered malicious software, and on October 21, the company began a phased shutdown of the servers.

GMO confirmed the presence of vulnerabilities, unauthorized access to the infrastructure, and leakage of user information. In particular, the attackers could obtain account credentials for MetaTrader 4 and MetaTrader 5 trading platforms stored on client servers. This created a threat of direct interference in trading operations. Some users discovered unknown transactions and reported losses. TV Asahi reported on a 44-year-old resident of Kanagawa Prefecture who estimated the damage from unauthorized operations at more than 6 million yen ($38,175). The total amount of client losses has not yet been determined.

The alleged perpetrator demanded money, threatening to publish confidential information, further interfere with the accounts of more than 70 brokerage and Forex companies, and carry out ransomware attacks. GMO refused to comply with the demands and handed over the materials to the police. The company agreed with financial platforms to block suspicious operations and forcibly terminate active sessions.

GMO promised to fully compensate confirmed losses from unauthorized transactions, including trading losses and commissions. To receive compensation, clients need to provide a transaction history and other information confirming the fact of interference; lost profits and indirect losses are not subject to compensation. Each active user of the service will receive 5,000 yen regardless of financial damage. GMO will also offer clients an alternative platform with free service for six months.

Government Response

Following the incident, the company appealed to the Japanese government to activate the active cyber defense mechanism. It came into effect on October 1, 2026, and allows the police and Self-Defense Forces to intervene in the infrastructure of attackers to neutralize cyber threats, provided legal conditions are met.

On October 26, Japan's Chief Cabinet Secretary Minoru Kihara stated that the decision to apply the mechanism is made by authorized government bodies independently of the affected organization's request. The official declined to disclose specific government actions regarding GMO. There is no confirmation of the mechanism's application in this incident yet.