Finding
A compromise of GMO Internet’s Onamae.com Desktop Cloud turned a hosted Windows service into a route toward customers’ financial accounts. GMO says it detected unauthorized access on October 20, found malicious programs installed in some customer server environments, and suspended the service at 4:00 a.m. Japan time on October 21. Its initial notice said as many as 26,739 server environments could be affected.
By October 24, the company had confirmed that customer information was taken. Some customers also reported unauthorized operations in securities and foreign-exchange trading accounts accessed through the cloud desktops. GMO asked more than 70 financial companies to block access from the service, terminate sessions and watch for unauthorized transactions.
This was therefore more than a conventional cloud outage or disclosure event. A service marketed for continuously running automated trading tools became a bridge between a provider compromise and customers’ live financial sessions. GMO offered compensation for unauthorized losses and a ¥5,000 goodwill payment to current customers.
Timeline
October 20: GMO detected unauthorized access. October 21, 4:00 a.m. JST: it suspended all Onamae.com Desktop Cloud plans. The company also received a threat demanding roughly ¥8 billion. October 22: GMO consulted police. October 24: GMO confirmed security weaknesses, unauthorized access and customer-data exfiltration; it also disclosed reports of unauthorized trading-account activity.
October 27: the attacker published information claimed to belong to GMO and its customers. GMO urged customers to back up data, disconnect affected PCs from networks and power them off while analysis continued. October 28: GMO said the site carrying the leaked material had been taken down. Its latest report said analysis of submitted customer PCs had found no trace of malware infection or ransomware attack, though the investigation continued.
The final point matters. GMO confirmed the intrusion, malicious programs in cloud server environments and data theft, but it has not confirmed that ransomware executed on customer PCs. The attacker’s deadline and threats should not be rewritten as a completed ransomware event.
Lessons
Containment must follow the authenticated session. Suspending a remote-desktop platform may stop new use, but it does not necessarily close brokerage sessions or revoke credentials already exposed through compromised desktops. GMO’s coordination with more than 70 financial firms—blocking access, terminating sessions and monitoring transactions—shows the downstream work needed when one hosted workspace connects to many high-value systems.
Always-on convenience creates concentrated risk. Cloud desktops are attractive for automated trading because they stay online. The same feature makes a provider compromise unusually consequential: attackers may inherit persistent access, stored credentials and active sessions in one place.
Recovery needs customer-device evidence. Restoring the provider’s infrastructure is only part of recovery. Affected users need endpoint analysis, clean replacements where necessary, verified backups, credential rotation and a controlled return to service. GMO’s offers to analyze or replace customer PCs recognize that the trust boundary extended beyond its own servers.
What remains uncertain
GMO has not published a root cause, a confirmed count of compromised server environments or customers, a final service-restoration date, or a verified total for unauthorized financial losses. The intrusion and data theft are confirmed; ransomware activation on analyzed customer PCs is not.
Sources & method
AI-assisted research and drafting, reviewed by the editor before publication. Reporting is attributed to the sources below; this is not an independent forensic investigation.
- Apology and Notice Regarding Unauthorized Access by a Third Party to Onamae.com Desktop Cloud · Original source · 2026-10-21
- Notice and Apology Regarding Unauthorized Access to Onamae.com Desktop Cloud (Fourth Report) · Original source · 2026-10-24
- Current Response to Unauthorized Access to Onamae.com Desktop Cloud (Tenth Report) · Original source · 2026-10-27
- Current Response to Unauthorized Access to Onamae.com Desktop Cloud (Fourteenth Report) · Original source · 2026-10-28
- Japan’s GMO urges customers to shut down PCs amid ransomware threat · Reporting · 2026-10-27
- Japan internet giant GMO says hackers posted stolen customer data · Reporting · 2026-10-27