The GMO cyber attack has disrupted a remote desktop service used by online traders and exposed customer information. A party claiming responsibility demanded US$1 million and threatened data leaks and ransomware attacks.
GMO Internet confirmed unauthorised access to its Onamae.com Desktop Cloud environment, malicious programs on some customer servers and the theft of customer data. Some users also reported unauthorised trades on brokerage or foreign exchange accounts.
What happened in the GMO cyber attack
Onamae.com Desktop Cloud is a Windows remote desktop hosting service operated by GMO Internet. It is widely used to run foreign exchange trading applications, including MetaTrader 4 and MetaTrader 5, on remotely hosted Windows systems.
GMO began investigating after receiving a customer enquiry on 19 October 2026. On 20 October, it confirmed that malicious programs had been installed in some customer server environments and restricted new registrations and access to the service control panel.
At around 04:00 JST on 21 October, GMO shut down servers across all Onamae.com Desktop Cloud plans. The company issued its first public notice later that day and continued investigating the affected infrastructure.
The investigation subsequently established that a third party had gained unauthorised access to the service environment. GMO confirmed a security problem within the system, the presence of malicious software on some hosted servers and the transfer of customer information outside its environment.
The company has not disclosed the initial intrusion vector or identified a specific software vulnerability. No public exploit code, malware hashes, malicious IP addresses or other technical indicators have been released.
Potentially affected systems
All Onamae.com Desktop Cloud plans were taken offline, rather than a particular software version or subscription tier. GMO cited a working investigation scope of 26,739 servers as of 23 October, but stressed that this was not the number of servers confirmed as compromised.
GMO later decided not to restart the service on its existing infrastructure. Customers are instead being offered access to a replacement platform built on separate infrastructure, free of charge for six months.
GMO cyber attack ransom demands explained
Reporting around the GMO cyber attack contains two different extortion figures. These appear to relate to demands made at different stages, but GMO has not confirmed whether they came from the same individual or group.
An initial extortion email reportedly arrived at 11:57 JST on 21 October. Details later published by GMO’s chief executive indicated that it demanded US$50 million in cryptocurrency, with a payment deadline of 17:00 JST that day.
A separate statement appeared on an attacker-linked site on 24 October. It demanded US$1 million by noon JST on 27 October and threatened to publish information about GMO and its customers, continue interfering with customer trading accounts and launch ransomware attacks against users’ PCs.
GMO has acknowledged receiving extortion threats, but its official advisories do not state a ransom amount. The company refused to pay, referred the incident to police and said it would continue cooperating with the authorities.
By 27 October, people believed to be responsible had published information they claimed was connected to GMO and its customers. GMO warned users not to visit the attacker-linked site or open messages and links purporting to come from the attackers.
Crucially, GMO said that no ransomware attack had been confirmed as of 13:55 JST on 27 October. The ransomware element therefore remained a threat rather than a verified impact at that point.
Timeline of the GMO cyber attack
-
19 October 2026: GMO begins investigating following a customer enquiry.
-
20 October 2026: Malicious programs are confirmed on some customer server environments. New registrations and control panel access are restricted.
-
21 October 2026: All service plans are shut down at around 04:00 JST. An initial US$50 million extortion email is reportedly received at 11:57 JST.
-
22 October 2026: GMO publishes its second incident report and provides further customer guidance.
-
24 October 2026: GMO confirms data exfiltration, announces its compensation policy and says it will not pay the attackers. An attacker-linked statement separately demands US$1 million.
-
26 October 2026: GMO’s chief executive publicises details of the reported US$50 million demand.
-
27 October 2026: GMO confirms the publication of purported stolen data, while reporting that no ransomware attack has been verified.
-
28 October 2026: GMO offers a reward of up to US$1 million for information that helps identify those responsible.
Unauthorised trades and possible technical access
The GMO cyber attack created risks beyond the loss of personal or service information. Some customers reported unauthorised activity on brokerage or foreign exchange accounts accessed through their hosted trading environments.
GMO committed to compensating verified realised losses resulting from unauthorised trades. It also announced a 5,000 yen goodwill payment for every current Onamae.com Desktop Cloud user.
One important concern is that changing a brokerage password may not terminate sessions that are already active. GMO therefore told affected customers to contact their brokers and forcibly disconnect all existing sessions, rather than relying on a password reset alone.
The attackers also claimed that centralised administration and Remote Desktop settings allowed access to drives connected from customer devices. A security analysis referenced apparent file copying through Remote Desktop drive redirection paths such as \\tsclient\C. These claims have not been independently confirmed by GMO and should not be treated as an established explanation of the intrusion.
Current exploitation status and response
Exploitation is confirmed. The verified effects include unauthorised access, malicious programs in some customer environments, data exfiltration and reports of unauthorised trading activity.
Attribution remains unknown. Neither GMO nor law enforcement has publicly named an attacker, and the company has not released evidence linking the GMO cyber attack to a recognised ransomware or cybercrime group.
The US$1 million reward announced on 28 October is separate from the ransom demand. GMO is offering up to that amount for information leading to the identification of the perpetrators, while maintaining its refusal to fund the extortion attempt.
What affected organisations and users should do
Users should follow GMO’s incident-specific instructions and treat systems that accessed the service as potentially exposed. Recommended actions include:
-
Change service, broker and trading account passwords from a device believed to be safe.
-
Ask brokers to terminate every active account session.
-
Run a full antivirus scan on local devices connected to hosted desktops.
-
Review trading histories and report unauthorised transactions promptly.
-
Back up important data and avoid attacker-linked websites, emails and downloads.
Organisations dependent on hosted desktops should also confirm whether replacement infrastructure has been activated and preserve relevant logs. Because GMO has not published indicators of compromise or the initial entry method, direct communication from the provider and careful account monitoring remain central to the response.
Originally reported by The Independent.
