Japanese company GMO Internet confirmed a large-scale cyberattack on its Onamae.com Desktop Cloud service, saying attackers gained unauthorized access to its infrastructure and user information. The investigation began on October 19 after client reports, and the incident matters because attackers may have obtained trading-platform credentials and used them to execute unauthorized transactions.

Onamae.com Desktop Cloud is a virtual desktop service that some clients use for automated trading in the foreign exchange market. According to The Japan Times, up to 26,739 servers were potentially at risk, although that figure represents potentially affected infrastructure rather than a confirmed number of compromised systems.

Unauthorized access and reported losses

GMO began investigating on October 19, detected malware the following day and started a phased shutdown of servers on October 21. The company confirmed vulnerabilities, unauthorized access to its infrastructure and a leak of user information.

Attackers may have obtained credentials for the MetaTrader 4 and MetaTrader 5 trading platforms that clients stored on their servers. Some users subsequently reported trades executed without their consent and resulting financial losses.

TV Asahi reported that a 44-year-old resident of Kanagawa Prefecture estimated his losses from unauthorized transactions at more than 6 million yen ($38,175). The man said the incident initially caused him to panic.

The total amount of client losses has not been determined. GMO is continuing its investigation and reviewing claims from affected customers.

The alleged attacker also demanded money and threatened to publish confidential information, further interfere with client accounts at more than 70 brokerage and foreign exchange firms, and carry out ransomware attacks. GMO refused the demand and provided related materials to the police.

The company also reached agreements with financial platforms to block suspicious transactions and forcibly terminate active sessions.

Compensation plan

GMO said it would fully reimburse confirmed losses from unauthorized trades, including trading losses and fees. Customers seeking compensation must submit their transaction histories and other information that can establish that unauthorized interference occurred.

Lost profits and indirect damages are not eligible for compensation. Separately, every active user of the service will receive 5,000 yen, regardless of whether the user suffered a financial loss. GMO will also offer customers an alternative platform with six months of free service.

Request for active cyber defense

Following the attack, GMO asked the Japanese government to activate its active cyber defense mechanism. The framework took effect on October 1, 2026, and allows the police and Self-Defense Forces, subject to conditions set by law, to intervene in attackers’ infrastructure to neutralize cyber threats.

On October 26, Chief Cabinet Secretary Minoru Kihara said authorized government agencies decide whether to use the mechanism, regardless of a request from an affected organization.

Kihara declined to disclose the government’s specific actions in the GMO case. There has been no confirmation that the active cyber defense mechanism was used in connection with the incident.

Japanese authorities previously identified a series of cyberattacks by the North Korean hacking group Lazarus against domestic cryptocurrency exchanges, including Zaif and Bitpoint Japan.

Source: Incrypted