GMO Internet Group · Breach

GMO Desktop Cloud attack reportedly compromised over 26,000 servers

Nov 06, 2026 · 1 min read

GMO Internet Group, a major Japanese technology company, is investigating a cyberattack on its Desktop Cloud service, with more than 26,000 servers allegedly compromised, according to the AlertaMundial19 account on X. The investigation points to a North Korea-linked group as the possible culprit, and the attack would have exposed client and financial operations data. The extent of the impact has not been detailed; customers should watch for official GMO statements.

By HIFY Radar newsroom Updated 11/06/2026 07:35 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

GMO Internet Group, a major Japanese technology company, was hit by a cyberattack on its Desktop Cloud service, according to the AlertaMundial19 account on X. More than 26,000 servers were allegedly compromised. The investigation points to a North Korea-linked group as the possible culprit.

Why it matters

The attack would have exposed information related to clients and financial operations. The extent of the impact has not been detailed. Companies using Desktop Cloud may have sensitive data involved.

What to do

Desktop Cloud customers should contact GMO, review data and access tied to the service, and monitor official statements until the investigation progresses.

For the technical team

Affected: GMO Internet Group, grupo tecnológico japonês Serviço Desktop Cloud da GMO Internet Group; mais de 26 mil servidores sob investigação · GMO Internet Group Desktop Cloud service; more than 26,000 servers under investigation.
Exploitation: Attack reported by the AlertaMundial19 account on X, with servers allegedly compromised. No official confirmation from GMO and no method details in the sources.
Fix: No software to update
More details: The investigation points to a North Korea-linked group as the possible culprit. The attack would have exposed information related to clients and financial operations. The source cites a technical failure at 128 credit cooperatives in Japan and a drop in Asian markets in the same period, with no established connection to the attack.