Full Breakdown
GMO Internet’s Desktop Cloud Breach Exposes FX Traders to Cyberattack
By Drooid · · How we work
Core Event: Unauthorized Access to Onamae.com Desktop Cloud
GMO Internet Group disclosed that a third-party attacker installed malicious programs in the server environments of its Onamae.com Desktop Cloud service, which the company markets for foreign-exchange (FX) trading applications. The intrusion allowed the attacker to obtain users’ trading passwords, perform unauthorized operations on trading accounts, and exfiltrate customer data. GMO reported that some customers observed transactions they did not recognize and that the breach may have impacted 26,739 virtual-desktop (VDI) servers. The attacker demanded a $50 million cryptocurrency ransom; GMO refused to pay, citing uncertainty that payment would erase the stolen information or stop its misuse.
Background & Context: Rising Cyber Threats and New Japanese Cyber Law
The breach occurred amid a wave of cyber incidents targeting Japanese firms, prompting the government to emphasize “active cyber defense” under a legal framework that took effect less than a month earlier. The framework authorizes authorities to identify and neutralize emerging threats and to coordinate private-sector response.
Data & Statistics
- 26,739 VDI servers potentially compromised.
- $50 million ransom demand, which GMO declined.
- ¥5,000 (? $32) offered as a condolence payment to all affected users.
- GMO pledged to cover any trading losses directly caused by the breach.
- The attacker reportedly used “ARTEX,” an autonomous AI penetration-testing tool, to gain unauthorized access to roughly 20 Japanese companies.
Official Statements & Responses
Prime Minister Sanae Takaichi ordered her cabinet to compile emergency cyber-defense measures within the next week, directing the cybersecurity minister to cooperate with allies and international organizations to locate the threat source.
CEO Masatoshi Kumagai issued a blog post acknowledging that internal white-hat hackers had flagged security gaps, but that the company’s cautious prioritization of service availability delayed remediation. He warned that open-weight AI models have lowered the skill barrier for attackers, enabling tools like ARTEX to be weaponized and submitted a proposal for a “proactive cyber defense” partnership between public and private sectors.
GMO instructed customers to immediately change trading passwords using devices not employed for trading, to disconnect all active sessions, and to request that their brokers terminate any lingering sessions. The company also announced a six-month provision of a free alternative environment while it overhauls its infrastructure with external expert assistance.
Verbatim Quotes
- “In response to cyberattacks whose nature has been identified, we will strategically select and implement a full range of countermeasures — including taking steps to access and neutralize the threat,” — Sanae Takaichi, prime minister
What’s Next
The cabinet is tasked with finalizing emergency cyber-defense measures by the end of next week, including the establishment of a monitoring network for small and medium-sized enterprises. GMO will operate a free, secure desktop environment for six months while it conducts a comprehensive infrastructure overhaul with external experts and will continue to work with major trading platforms to terminate active sessions and monitor for further unauthorized activity.