Key facts
- GMO Group instructed customers of its Onamae Desktop Cloud service to disconnect from the internet, power down computers, and unplug all cables before noon on October 27, 2026.
- GMO Internet Group stated it would not pay the ransom demand.
- GMO said an October 20 intrusion could have placed malware on as many as 26,739 customer servers.
- GMO said as many as 26,739 servers could have been affected by the breach.
GMO Group told customers of its Japan-based Onamae Desktop Cloud service to disconnect from the internet, power down their computers, and unplug all cables before noon on Oct. 27, 2026. GMO Internet Group stated it would not pay the ransom demand. GMO CEO Masatoshi Kumagai said in a Monday blog post that the hacker demanded $50 million in cryptocurrency.
The directive followed an Oct. 20 intrusion in which a third party installed an unauthorized program on some customers’ servers. GMO said the breach could have placed malware on as many as 26,739 customer servers. Attackers installed malicious code on certain customer servers, potentially exposing stored trading login credentials. Onamae Desktop Cloud is a hosted desktop service operated by GMO Internet that rents Windows servers to traders.
On Oct. 20, an investigation sparked by a customer inquiry confirmed the unauthorized installation. From Oct. 21, customers reported trades they did not make. Attackers said they would keep placing unauthorized trades through accounts at over 70 securities and FX firms domestically and internationally. On Oct. 26, GMO said threat actors intended to publish customer information online and activate ransomware placed on customer servers earlier.
GMO confirmed that company data and customer data had been posted online. The company said company and customer data had been released by the threat actor, and work began to confirm whether the leaked material is real. As of 13:55 on Oct. 27, GMO stated no ransomware attack had been confirmed at that moment.
Payment information had not been exposed in the breach. GMO warned that MetaTrader 4 and MetaTrader 5 login credentials and trading-account information might have been exposed or compromised.
GMO’s eighth public update told customers to back up data, disconnect from the network, power down, and unplug PC cables before noon on Oct. 27. “Once you have a backup, disconnect the network, power it down, and unplug the cord that connects to your PC,” GMO said.
A hacker group stated they had set the deadline at 12 p.m. noon but GMO was not engaging in negotiations, so they would disclose personal information. “We have been setting the deadline at 12 p.m. (noon) but GMO is not engaging in any negotiations,” the hacker group said.
GMO said it will pay ¥5,000 to all current customers of the service, regardless of whether they lost money. The company also announced compensation of ¥5,000 for the inconvenience caused, and said it will consider additional financial compensation for customers whose information was exposed. GMO will pay up to 3 million yen ($19,000) to victims with confirmed personal information exposure. Under its GMO Cybercrime Bounty program, GMO will pay as much as $1 million for tips that identify hackers, starting at noon Wednesday and running until the perpetrators are arrested.
GMO’s Onamae Desktop Cloud will not come back, and customers may switch to a different cloud service at no cost for six months. Once GMO identifies countermeasures, it plans to send each service user an individual e-mail notification.
GMO told major exchanges and brokers to cut service access and end all active sessions. GMO asked police to open a criminal investigation into the breach.
Goldenway Japan Co. and Ava Trade Japan K.K. were among companies that told the Financial Services Agency their customers suffered from the GMO cyber attack. On Oct. 22, OANDA Japan informed customers that MT4 and MT5 login credentials on the service could have been exposed and that it temporarily suspended withdrawals. Finance Minister Satsuki Katayama said the government is pressing financial institutions to strengthen defenses against possible cyber attacks. “We cannot rule out the possibility of further unauthorized transactions, so we will respond with a sense of urgency,” Katayama said.
In a Saturday stock exchange filing, GMO requested Japan’s government to use its new active cyber defense powers to trace, block, and neutralize attackers’ infrastructure. GMO is not among the critical infrastructure operators designated under the new active cyber defense law. The new active cyber defense powers took effect on Oct. 1 during a surge in data disclosures.
Japan recorded 123 ransomware cases in the first half of 2026, a record high. The IDCF Cloud ransomware attack took 495 clients offline. No verified source has reported any stock movement for GMO shares connected to the warning.
Before opening an investigation, GMO shut down servers and cut back service availability. Because ransomware needs a powered-on computer and typically a network connection to spread, a switched-off machine with no cables attached cannot encrypt files, accept commands, or travel to other systems.
No ransomware was activated on customer machines according to the company’s reporting. GMO warned people and media not to disseminate exposed information and announced it will take legal action against those who do.
Join the discussion