Full Breakdown
GMO Internet Seeks Government-Led Active Cyber Defense After Large-Scale Server Breach
By Drooid · · How we work
Unauthorized Access and Immediate Impact
GMO Internet Group Inc., a Japanese IT services provider, disclosed that an unauthorized third-party accessed its “Onamae.com Desktop Cloud” service, which hosts virtual servers used for automated foreign-exchange (FX) margin trading. The breach allowed attackers to obtain user login credentials and execute fraudulent trades on accounts at more than 70 domestic and overseas securities and FX firms. The company shut down all affected servers on October 21, 2026 and began compensating users for verified trading losses. It also announced a ¥5,000 goodwill payment to every current user of the service.
Background on the Service and Active Cyber Defense
Onamae.com Desktop Cloud provides a Windows-based virtual private server (VPS) that enables traders to run MetaTrader 4 or MetaTrader 5 tools continuously. The Japanese government operates an “active cyber defense” framework that permits police and the Self-Defense Forces to infiltrate attackers’ infrastructure. GMO Internet argued that private-sector defenses alone are insufficient and requested activation of this framework.
Timeline of Key Developments
| Date (as listed) | Event |
|---|---|
| October 19 | Internal investigation began after user inquiries about suspicious activity. |
| October 20 | Company confirmed malicious programs on some servers and suspended new applications and control-panel access. |
| October 21 | All servers were shut down starting at 4 a.m.; no confirmed leakage of personal data at that time. |
| October 22 | GMO disclosed possible credential theft, consulted police, and urged users to change passwords and log off devices. |
| October 23 | Users were asked to log off, scan devices, and change passwords again. |
| October 24 (scheduled) | Public request for government activation of active cyber defense; announced compensation and goodwill payments. |
| October 30 (scheduled) | Deadline for sending guidance on the goodwill payment and alternative cloud service. |
| November 6 (deadline) | Deadline for loss-compensation applications. |
Data and Compensation Measures
- Potentially affected servers: 26,739 (potential, not confirmed).
- Goodwill payment: ¥5,000 (? $32) to every current user.
- Loss compensation: Covers realized trading losses and fees attributed to the unauthorized access; excludes market-movement losses and indirect damages.
- Alternative service: Users may migrate, at no cost, to an independent cloud platform for six months; the original platform will not restart without a security overhaul.
Official Statements and Regulatory Response
- The company warned users against phishing attempts impersonating the firm.
- Japan’s Financial Services Agency (FSA) issued an emergency notice (dated October 22) urging FX operators to require password changes, strengthen two-factor authentication, and monitor for suspicious transactions.
- OANDA Securities and AI Gold Securities advised their customers to change trading-account passwords, enable two-factor authentication, and review transaction histories on October 22.
Conflicting Reports and Gaps
- The figure 26,739 is repeatedly cited as the count of potentially affected servers, but GMO clarified it does not represent confirmed intrusions or data acquisitions. No public confirmation exists regarding the extent of credential leakage or any exfiltrated personal information beyond login details.
What’s Next
- The government’s decision on invoking active cyber defense is pending; activation would be the first use of the measure since the framework began operating earlier in October.
- Users must submit loss-compensation applications by November 6 and will receive guidance on the ¥5,000 goodwill payment by October 30.
- GMO Internet plans to overhaul its security architecture and migrate customers to a new independent cloud platform, but a timeline for resuming the original service has not been announced.