Attackers broke into Onamae.com Desktop Cloud, a hosted Windows VPS service run by GMO Internet (part of Japan's GMO Internet Group). They planted malicious programs on customer servers that traders use to run MetaTrader 4 and 5 (MT4/MT5) and automated forex tools around the clock. GMO's own notice says up to 26,739 servers may be affected. The company stresses that this is the number of servers that could be affected, not a count of confirmed infections. Customers have since reported trades they did not authorise. The attackers have demanded payment and threatened to leak customer and company data. On Saturday, October 24, GMO said in a stock exchange filing that it had asked the Japanese government to use its new active cyber defence powers against the attackers' infrastructure. Those powers took effect on October 1, and reports describe this as the first known request to use them.
What Happened
The timeline below combines GMO's notices with security press reporting:
- October 20, 2026: GMO confirmed that a third party had installed "malicious programs" in some customers' server environments on Onamae.com Desktop Cloud (GMO notice; BleepingComputer).
- October 21, 04:00 JST: GMO began shutting down servers in sequence across all Desktop Cloud plans. It gave no date for restoring service (GMO notice; BleepingComputer; Hacker Posts). From the same day, customers began reporting trades they had not made (The Next Web; Botnet Ledger).
- October 22: In its second report, GMO said trading-account login details saved in trading tools on the servers may have been taken and misused (Rescana; Japan Cyber Watch). OANDA Japan told customers that MT4/MT5 logins used on the service may have been exposed and briefly held withdrawals for a security check (The Next Web). Japan Cyber Watch reports that FXTF also warned that an attack on "another company's VPS servers" may have led to logins and trades in some customer accounts.
- October 23, 16:10 JST: GMO's third report urged customers to change trading-account and trading-tool passwords and to disconnect all logged-in sessions. It warned that on some brokers' systems, existing sessions can stay live after a password change and keep trading (Rescana).
- October 24: GMO disclosed the extortion demand and said it would not pay, because payment would not guarantee the data is deleted or stop it being misused. It asked police to open a criminal investigation and asked the government to invoke active cyber defence (The Next Web; Japan Cyber Watch; Botnet Ledger).
According to The Next Web and Japan Cyber Watch, the attackers threatened to:
- keep placing unauthorised orders through accounts at more than 70 securities and FX firms in Japan and abroad
- leak customer and company data
- launch a ransomware attack
GMO has warned that anything the attackers publish may be partly false. It has also asked major exchanges and brokers to block access from the service and to cut off all active sessions.
The sources differ on what happens to the service next. Botnet Ledger reports that GMO will close it permanently. Japan Cyber Watch says GMO will rebuild it on a separate platform. Both say GMO will compensate customers' trading losses. Japan Cyber Watch also reports a flat ¥5,000 payment to every current user. That figure appears in only one source and has not been independently confirmed.
What Was Taken
The data exposure is still being investigated, and GMO's position has changed over the week.
- The initial notice (October 21) said information stored on the servers "may have been viewed", but that GMO had not confirmed any leak or misuse of the personal information customers entrusted to it.
- By October 22, GMO said trading-account credentials stored in MT4/MT5 and other tools on the servers may have been obtained and used illegally. Customer reports of unauthorised trading support this.
- By October 24, Japan Cyber Watch reports that GMO said the attackers had taken customer data. The extortion threat also covers company data.
- Payment data: All sources agree that GMO does not keep payment information, including credit card data, on the service's servers.
No record counts, data volumes or confirmed victim totals have been published. The 26,739 figure counts servers that could be affected, not stolen records or confirmed compromises. GMO says its investigation, carried out with an external cybersecurity firm, also covers possible impact on customers' own devices (Rescana).
Why It Matters
Hosted trading boxes concentrate credentials. Desktop Cloud was marketed as "ideal for stable FX automated trading." Each server ran trading software that was always on and always logged in. Compromising the platform gave the attackers working sessions into brokerage accounts at dozens of firms at once, without phishing a single trader. Japan Cyber Watch notes this is the second route this month by which attackers have reached Japanese investors' accounts without phishing, after unauthorised trades at Iwai Cosmo Securities.
Changing a password does not end a live session. GMO warned that on some brokers' systems, sessions stay connected after a password change. That means the usual "rotate your credentials" advice is not enough on its own. Brokers have to revoke sessions on the server side.
This is the first test of Japan's active cyber defence law. If the government grants GMO's request, police and the Self-Defense Forces could trace, block and neutralise attacker infrastructure. How the government responds will set the precedent for future private-sector requests.
It sits within a wider breach wave. GMO's security arm, GMO Cybersecurity by Ierae, separately reported that attackers behind Japan's autumn breach wave used ARTEX, an open-source AI penetration-testing tool developed in China, against about 20 Japanese companies (Japan Cyber Watch). JPCERT/CC has since named ARTEX, Cairn and CyberStrikeAI in its advisory. No source links the Desktop Cloud intrusion to ARTEX or to that campaign, and readers should not assume a connection.
The Attack Technique
The entry vector is not well understood, and the accounts have changed over time.
- As of October 22–23, GMO had not published the entry vector, the malware family, any CVE, or any indicators of compromise (IOCs), and had not attributed the attack to any actor (Hacker Posts; Rescana).
- On October 24, according to Japan Cyber Watch, GMO said a security problem in the service's own system let the attackers in. No further technical detail has been given.
What is established is the sequence that followed:
- The attackers gained access at the platform level.
- They deployed malicious programs into customer Windows environments.
- They harvested credentials and sessions from the trading tools on those servers.
- They placed unauthorised trades through brokerage accounts.
- They extorted GMO, threatening a data leak and ransomware.
Some headlines call this a "ransomware" incident. Based on the sources, ransomware was a threat the attackers made, not a confirmed encryption event.
What Organizations Should Do
- Treat everything on Desktop Cloud as exposed. Rotate trading-platform passwords, API keys, saved sessions and any reused passwords, and do it from a clean machine rather than the affected VPS.
- Revoke sessions on the server side, not just passwords. Brokers and exchanges should force a logout of every active session tied to the service's IP ranges and block new access from them, as GMO has asked.
- Watch brokerage accounts for unauthorised activity. Firms should look for anomalous orders and withdrawal attempts. Temporary withdrawal holds, as OANDA Japan used, are a reasonable containment step.
- Check endpoints that connected to the VPS. GMO is investigating impact on customers' own devices. Scan any machines that used RDP or shared clipboards or drives with Desktop Cloud instances.
- Prepare for phishing that uses the incident as a lure. GMO says it will never ask for passwords or card data by email or phone. Brief staff and customers on that.
- Review risk from shared hosting. Any provider that hosts always-logged-in financial tooling for many customers concentrates risk. Require MFA and IP-bound sessions where brokers support them, and do not rely only on version-based patching or WAFs, which GMO's own researchers say AI-assisted attackers are getting around.
Sources: GMO Internet Group seeks state cyber powers after ransomware | Japan's Onamae Desktop Cloud hacked, up to ... | Important Apology and Notice Regarding Unauthorized Access by a Thi... | Onamae Desktop Cloud breach may hit 26,739 GMO servers Hacker Posts | GMO's Onamae.com Desktop Cloud Breach: Extortion, FX Accounts Trade... | GMO asks Japan to use new cyber defence powers after hack | GMO Internet Onamae.com Desktop Cloud Breach: All Plans Shut Down A... | ARTEX: GMO Finds a Chinese AI Pentest Tool on Servers Attacking Jap...