GMO Internet is investigating a suspected data leak involving Onamae Desktop Cloud, a service that provides virtualized desktops to financial traders. The company says information allegedly linked to customers and its business has been posted online, but it has not confirmed whether the material is genuine or how much information may be involved.
What GMO has confirmed so far
The Japanese internet and IT services company says it believes an attacker published information connected to the company and its customers. Its verification is ongoing, so the contents and full extent of the incident remain unclear.
GMO has advised customers to reset their passwords. It has also received reports of “unauthorized operations” on customer trading accounts. The company said 27,000 servers may be affected, a figure that signals the possible scale of the incident without establishing how many customers or accounts have been harmed.
The service was shut down after GMO discovered unauthorized access to its systems. The company has since said it would offer customers compensation and an alternative service. It also began collecting customer devices to look for malware and better understand the damage.
How the response has unfolded
GMO’s public updates describe a response that has moved from shutting down the service to investigating devices and addressing customer needs. The company reported the incident to Japanese police and shared updates as its understanding developed.
- Oct 21: GMO shut down Onamae Desktop Cloud after discovering unauthorized access. It also received an email from hackers demanding about 8 billion yen (~$50 million).
- Oct 22: The company reported the incident to Japanese police and shared another public update.
- Oct 24: GMO said it would offer compensation and an alternative service while seeking help from government agencies.
- Oct 25-26: The company began collecting customer devices to check for malware and assess the damage.
- Oct 27: GMO said a suspected attacker had posted information apparently linked to the company and its customers. It was still checking whether that information was genuine.
These steps address different parts of the problem: limiting further access, investigating potential malware, and supporting customers while the facts are established. The company’s updates do not yet settle what data was taken, whether the posted material is authentic, or the full effect on customer trading accounts.
Questions about the wider cyber threat
The incident follows a separate report from GMO Internet’s cybersecurity unit about evidence that an AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan. GMO has not publicly established a connection between Artex and the Onamae breach, so the two developments should not be treated as linked.
A CrowdStrike report earlier this month said Artex was also used in attacks on financial institutions in South Korea in September. The attacks largely relied on weak security controls, including a lack of multi-factor authentication. Reuters reported that Artex’s Chinese developer stopped public updates and made the tool closed-source after it was linked to cyberattacks targeting banks.
What the incident means for customers and firms
For Onamae customers, GMO’s password-reset advice is an immediate step while the investigation continues. The reports of unauthorized account operations make the company’s guidance especially relevant to customers who use the service for trading. GMO’s planned device collection and alternative service offer are part of its response, though the company has not yet described the complete impact.
Japan’s Financial Service Agency (FSA) told TechCrunch it issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities. The regulator called for stronger basic defenses, including “vulnerability management, defense-in-depth and incident preparedness,” and encouraged firms to use AI and other security tools.
The episode underlines why preparation and incident response matter: access can be disrupted, customers may need to act, and public claims about stolen data can remain unverified while investigators work. For now, GMO’s published updates leave key questions open, including whether the material posted is authentic and how many systems or customers were affected.