GMO Internet Onamae.com Desktop Cloud · Breach

GMO refuses ransom; attackers publish customer data and threaten ransomware

Oct 19, 2026 · 2 min read

GMO confirmed a breach of Onamae.com Desktop Cloud, a cloud service used to run trading tools such as MT4/MT5, with unauthorized transactions in customer accounts. After GMO refused the $50 million ransom, the attackers published stolen data, whose authenticity GMO is verifying, and threaten to trigger ransomware planted on the cloud PCs; GMO asks customers to power off machines, unplug network cables, and offers up to $1 million for leads. The company says it will fully compensate confirmed losses.

By HIFY Radar newsroom Updated 10/28/2026 01:35 PM Get this every day →← Back to the feed 10 sources

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

GMO confirmed a breach of its Onamae.com Desktop Cloud service, which customers use to run trading tools (MT4/MT5) from securities and FX firms. Unauthorized transactions hit customer accounts, and social media reports cite financial losses. After GMO refused a $50 million ransom, the attackers published stolen data and threaten to trigger ransomware planted on the cloud PCs.

Why it matters

Customers had investment accounts traded without authorization and their data exposed. GMO says it will cover confirmed losses, even if exchanges refuse refunds, and will pay 5,000 yen to each affected user. The group president admitted internal engineers had flagged security issues in the service before the attack.

What to do

Follow GMO's notice: power off the service PCs and unplug the network cable. From a different device, change trading account and tool passwords, end all open sessions with the brokers, enable two-factor authentication, and check statements and balances. Hunt and replace credentials reused on other services.

For the technical team

Affected: GMO Internet Onamae.com Desktop Cloud (ambientes VPS de clientes) · Onamae.com Desktop Cloud (GMO Internet), customer VPS environments during the compromise. GMO-indicated start: October 20, 2026.
Exploitation: Production exploitation confirmed by GMO: unauthorized transactions in customer accounts on the service. Suspected hackers published stolen data on a website; GMO is verifying the material's authenticity, confirmed the site was taken down, and warns of a possible new site (Yomiuri). The @MTSlive account reports GMO refused a $50 million ransom and the attackers threaten to trigger, before noon, ransomware planted on the cloud PCs; GMO treats it as a risk and asks customers to disconnect.
Fix: No patch. Mitigations requested by GMO (5th notice, Oct 24, 2026, 15:00): power off the PCs and unplug the network cable; run a full antivirus scan on customer devices (PC and smartphone); back up data, handling backup files with care; change trading account and tool passwords from a device outside the service; terminate all active sessions, including requests to brokers; check transaction history and balances; enable two-factor authentication; change credentials stored on the server and in the browser; do not open links or files or reply to messages from someone claiming to be the attacker.
Vector: Unauthorized third-party access to Onamae.com Desktop Cloud, a service hosting customer VPS environments running trading tools (MT4/MT5). GMO did not detail the technical vector of the breach. The group president said internal engineers had flagged security issues to improve before the attack and that the response was insufficient. Condition: customer environments active on the service during the compromise.
More details: GMO opened a reward program on Oct 28, 2026, offering up to $1 million for leads leading to the attackers' arrest. President Kumagai apologized in a blog post (Oct 25, 2026): full compensation for losses from unauthorized transactions, even if exchanges do not refund; 5,000 yen to each affected user; six months of free alternative service; infrastructure overhaul; root cause analysis with external experts; request to the Japanese government to apply active cyber defense. Contact: help.onamae.com/contact/ and phone 03-5456-2560 (24 hours, including weekends and holidays).

Timeline

10/28/2026 01:35 PM
GMO now urges customers to unplug their PCs as a precaution against a possible ransomware attack.
10/28/2026 04:16 AM
GMO refused to pay the extortion and opened a reward program on October 28 offering up to $1 million for tips that lead to the attackers' arrest.
10/27/2026 08:37 PM
GMO now urges customers to shut down their PCs while it assesses ransomware risk tied to the breach.

Want the next updates in your inbox? Get the daily edition →

See all 6 updates

10/27/2026 10:37 AM
Suspected hackers post customer data stolen in the cloud service breach, and GMO says it is verifying the material.
10/27/2026 01:10 AM
GMO Internet refused a $50M ransom and the attackers now threaten to trigger, still today, ransomware covertly planted on customers' cloud PCs; the company urges users to unplug network cables and power off their machines before noon.
10/26/2026 01:20 PM
Incident opened.