GMO Internet's Onamae.com Desktop Cloud breached: data posted, ¥8B ($50M) extortion refused, $1M bounty offered, up to 26,739 servers

Linha do tempo

1. infosecurity-magazine.com ↗ · pub. 28/10/2026 12:49 · coletado 28/10 16:01

   GMO Internet's Onamae.com virtual desktop service breached; ¥8bn extortion demand and ransomware threat

   ler a análise desta fonte ocultar

   GMO Internet suspended its Onamae.com virtual desktop service in Japan on October 21 after discovering on October 20 that "malicious programs" had been installed in some customers' server environments. Up to 26,739 servers may be affected. The service is popular with foreign-exchange traders, and some reports suggest attackers accessed trading accounts and made unauthorized transactions. An extortion email on October 21 demanded about eight billion yen (~$50.7m). GMO refused to pay, and the attackers said they would deploy ransomware on October 27 at 12pm.

   Technical Details

   • The article names no threat actor, malware family or initial access vector.
   • GMO told customers to run a full virus scan, back up data, disconnect PCs from the internet and power them off. It is also asking customers to ship their PCs for forensic analysis.
   • As of October 27, 11:59, no malware, including ransomware, had been detected on the devices analyzed. Analysis is ongoing and not all customer devices have been checked.
   • Phillip Wylie of Suzu Labs commented that a vulnerability in a remote access service can have consequences far beyond the compromised system. This is general commentary, not a confirmed root cause.

   Remediation

   • Customers should run full antivirus scans, back up data, disconnect affected PCs and power them off.
   • Customers should ship devices to GMO for analysis when asked.
   • Defenders should limit what attackers can do after gaining access, in addition to preventing the initial compromise.

   The incident adds to a string of major data breaches at Japanese firms this year, including Burger King, Times Car, Daiichi Kosho and Yakiniku King.

2. gbhackers.com ↗ · pub. 28/10/2026 06:50 · coletado 28/10 07:00

   GMO Internet Onamae.com Desktop Cloud breached; ¥8B extortion demand and ransomware threat prompt customer PC disconnection

   ler a análise desta fonte ocultar

   GMO Internet Group disclosed unauthorized access to its Onamae.com Desktop Cloud remote desktop service, used mainly by financial traders. It suspended the service on October 21 and received an extortion demand of about ¥8 billion (~$50 million) the same day. After the attackers threatened to publish customer data and launch ransomware at noon on October 27, GMO told customers to back up data, disconnect their PCs from networks, shut them down and unplug cables. As of 13:55 JST on October 27, no ransomware attack had been confirmed. GMO said it will not pay, and that suspected attackers have already published information that appears to relate to the company and its customers.

   Technical Details

   • Reporting identified 26,739 potentially affected virtual desktop servers. This is a count of potentially exposed infrastructure, not confirmed infected PCs or affected individuals.
   • Customers reported unauthorized activity in their trading accounts, so the incident goes beyond service availability.
   • GMO's white hat team is examining customer computers collected across Japan after an October 25 appeal. By 11:59 on October 27, no malware, including ransomware, had been found on the devices whose analysis was complete, and the investigation continues.
   • The police were consulted on October 22. The investigation covers possible customer account abuse and compromised infrastructure.
   • The initial access vector and the threat actor have not been disclosed.
   • Publication of suspected stolen data does not by itself show that customer endpoints were encrypted.

   Remediation

   • Run full antivirus scans, not quick scans, and back up important files while disconnected from the network.
   • From a separate, safe device, use official websites to end active sessions, change credentials (including financial accounts) and enable multifactor authentication.
   • Remove unfamiliar linked applications, forwarding rules, extensions and registered devices.
   • Keep browser synchronization disabled until checks are complete.
   • Avoid links received by email or SMS. GMO states it never asks for passwords or authentication codes. Customers should also beware of paid "loss recovery" offers.
   • GMO announced a ¥5,000 payment per customer and reimbursement of unauthorized trading losses.
3. thehackernews.com ↗ · pub. 28/10/2026 04:13 · coletado 28/10 06:00

   GMO Internet offers $1M bounty for hackers behind Onamae.com Desktop Cloud breach and $50M extortion demand

   ler a análise desta fonte ocultar

   GMO Internet Group has opened a GMO Cybercrime Bounty program worth up to $1 million for tips that lead to an arrest or an international wanted notice for the attackers who breached its Onamae.com Desktop Cloud service. GMO refused a roughly $50 million (about ¥8 billion) extortion demand received on October 21. The service hosts Windows desktops used for FX trading, and the attackers exfiltrated customer information. Brokers including OANDA Japan and FXTF have linked unauthorized trades to credentials believed to have been leaked from the GMO servers. GMO counts 26,739 servers as potentially affected, which is not a confirmed count of intrusions or thefts.

   Technical Details

   • GMO found on October 20 that a third party had installed malicious programs on some customers' servers. It shut down servers on all plans from October 21, and on October 24 confirmed unauthorized access and exfiltration of customer information.
   • Data stored on the servers may have been viewed, including login credentials saved in trading software such as MetaTrader 4/5. GMO says it does not store payment card data on the servers.
   • OANDA Japan confirmed a third party logged in and traded on some customer accounts using ID/password pairs it believes were leaked from the GMO servers. As of October 26 it had found no break-in or leak in its own core systems. FXTF warned on October 22 of possible theft of logins from customers using VPS servers.
   • The attackers threatened to keep manipulating accounts at more than 70 securities and FX firms, to publish customer and system information, and to launch ransomware against customers' PCs. They set noon on October 27 as the deadline. No ransomware attack had been confirmed as of 1:55 p.m. Japan time that day.
   • On October 27 the attackers posted material they described as one customer's personal information. Their site, including mirrors, was taken down at about 4 a.m. Japan time on October 28. GMO says the site collected information about its visitors.
   • The attackers claimed (reported by ITmedia NEWS) that one administrator account was shared across all servers, that customers' PC drives were visible from the servers by default, and that they used a flaw in the service to reach customers' PCs. GMO has not confirmed these claims or said how the attackers got in.
   • GMO group head Masatoshi Kumagai wrote on October 25 that the group's white-hat hackers had warned the service team in advance, and that the response was neither fast nor thorough enough.
   • GMO's analysis of customer PCs found no malware, including ransomware, on those checked as of October 27, but the analysis is ongoing.

   Remediation

   • Change trading-account and trading-software passwords from a device not used for FX trading, and end all logged-in sessions.
   • Check trading history and balances, report unrecognized trades to the broker, and enable two-factor authentication.
   • Change reused or browser-saved passwords, run a full antivirus scan on connecting devices, and back up data.
   • Do not engage with, or open links or files from, anyone claiming to be the attackers, and do not visit their site. Ignore paid fund-recovery offers.
   • GMO will pay each current user ¥5,000, cover confirmed unauthorized trading losses and fees, and pay ¥10,000 to ¥25,000 per type of exposed information. It will not restart the service on the breached systems.
4. bleepingcomputer.com ↗ · pub. 27/10/2026 20:35 · coletado 27/10 21:00

   GMO Internet's Onamae Desktop Cloud breached; attacker leaks data and threatens ransomware on up to 26,739 customer servers

   ler a análise desta fonte ocultar

   GMO Internet (GMO Group) told customers of its Onamae Desktop Cloud VPS service in Japan to back up data, disconnect from the internet, shut down PCs and unplug cables. An attacker who breached the service threatened to trigger a ransomware payload planted on customer servers. GMO detected the intrusion on October 20; it could have placed malware on up to 26,739 customers' servers. The attacker demanded ¥8 billion (~$50 million), which GMO refused to pay. GMO later confirmed that company and customer data had been published online and is verifying its authenticity. The article says no ransomware appears to have been activated on customer machines.

   Technical Details

   • The attacker stole data and reportedly planted a ransomware payload on customer servers early in the attack. The threat was announced on October 26 and was to be triggered on October 27.
   • MetaTrader 4/5 (MT4/MT5) credentials and trading-account details may have been exposed. GMO says payment information was not exposed.
   • GMO shut down servers and reduced service availability, is scanning customer systems for residual malware, and is working with Trend Micro on recovery.
   • The article does not name the threat actor, the initial access vector, or any IOCs.

   Remediation

   • Back up data, disconnect the network, power down and unplug affected PCs, as GMO instructed.
   • Reset passwords, especially MT4/MT5 credentials, and terminate active sessions.
   • GMO is offering ¥5,000 (~$30) per customer, equivalent replacement PCs for ransomware victims, and possible additional compensation for those whose data was exposed.
   • GMO warned against disseminating the leaked data and said it will take legal action against those who do.
5. techcrunch.com ↗ · pub. 27/10/2026 10:32 · coletado 27/10 11:00

   GMO Internet confirms Onamae Desktop Cloud breach, hackers post stolen data after ~¥8 billion extortion demand

   ler a análise desta fonte ocultar

   GMO Internet is investigating a breach of its Onamae Desktop Cloud service, which provides virtualized desktops to financial traders. On 27 October a suspected attacker posted data that appears to be linked to the company and its customers, and GMO is still verifying whether it is genuine. The company shut the service down on 21 October after discovering unauthorized access and received an email from the attackers demanding about 8 billion yen (~$50 million). Customers reported "unauthorized operations" on their trading accounts, and up to 27,000 servers may be affected. GMO has not publicly linked the breach to the Chinese AI-enabled penetration testing tool Artex, which its security unit found used against Japanese companies a week earlier.

   Technical Details

   • Initial access vector and the full scope of the data leak are not yet established.
   • Customers are advised to reset passwords, and GMO is collecting customer devices (25-26 October) to detect malware and assess the damage.
   • Artex was also used against South Korean financial institutions in September, according to CrowdStrike. Those attacks largely relied on weak controls such as missing multi-factor authentication. Its developer has since stopped public updates and made it closed-source (Reuters).
   • Timeline: 21 Oct service shutdown and extortion email; 22 Oct police report; 24 Oct compensation and alternative service offered; 27 Oct data posted.

   Remediation

   • Affected customers should reset passwords and review trading account activity for unauthorized operations.
   • Japan's FSA guidance from May urges vulnerability management, defense-in-depth and incident preparedness.
6. theregister.com ↗ · pub. 26/10/2026 22:06 · coletado 26/10 23:00

   GMO Internet's Onamae.com Desktop Cloud breached: malware on VDI servers, FX trading accounts abused, $50M extortion demand

   ler a análise desta fonte ocultar

   GMO Internet disclosed that a third party installed malicious programs on customer server environments of its Onamae.com Desktop Cloud VDI service. The service is recommended for hosting foreign exchange (FX) trading applications. The company later confirmed that its systems had security vulnerabilities, that its environment was accessed without authorization, and that customer information was exfiltrated. Some customers reported unrecognized transactions on their trading accounts. GMO says it received a $50 million extortion demand from a person believed to be the attacker, who threatened to publish company and customer data. GMO refuses to pay. Up to 26,739 VDI servers may be affected, and investigations continue.

   Technical Details

   • Attackers installed malicious programs on customer VDI servers and probably captured users' trading-service passwords.
   • GMO's CEO Masatoshi Kumagai said in-house white-hat hackers had previously flagged weaknesses, but remediation was too slow and shallow, and the attackers exploited a vulnerability. No CVE or specific flaw is named.
   • Users' personal devices may also be at risk.
   • Some trading apps may keep sessions alive after a password change.
   • GMO asked major trading services to forcibly terminate active sessions, monitor for unauthorized transactions and block trade requests originating from Onamae.com Desktop Cloud.
   • Separately, Kumagai said GMO Group's cybersecurity operation found that an unauthorized access campaign against about 20 Japanese companies misused ARTEX, an autonomous AI penetration testing tool. The article does not say this campaign is the same incident as the Desktop Cloud breach.

   Remediation

   • Change trading account passwords immediately, using a device not used for trading.
   • Disconnect all active sessions with the securities or FX provider, or ask its support desk to do so.
   • GMO is offering a free alternative environment for six months, a ¥5,000 payment per user and compensation for trading losses. It is also overhauling its infrastructure with external experts.
7. gbhackers.com ↗ · pub. 22/10/2026 04:00 · coletado 22/10 04:00

   Malware planted on Onamae.com Desktop Cloud servers; 26,739 servers potentially affected, all plans suspended

   ler a análise desta fonte ocultar

   Attackers gained unauthorized access to Onamae.com Desktop Cloud, operated by GMO Internet, and installed malicious programs in some customer server environments. GMO confirmed the installations on October 20, 2026. On October 21 it began rolling shutdowns of all Desktop Cloud plans and identified 26,739 potentially affected servers. Information on those servers may have been viewed. Because Desktop Cloud is commonly used to run automated forex trading software, OANDA Japan warned on October 22 that MetaTrader 4/5 login credentials hosted there may have been exposed.

   Technical Details

   • The notice does not name the malware, initial access vector, exploited vulnerabilities, persistence mechanisms or attacker infrastructure, and it publishes no IOCs.
   • It is unclear whether a central management component, individual virtual servers or another part of the service was compromised.
   • The 26,739 figure counts potentially affected servers, not verified infections or customers.
   • There is no attribution, and the malware type (ransomware, stealer or cryptominer) is not established.
   • GMO says it has not confirmed leakage of customer personal information or misuse of viewed data, and that it does not retain payment card data. This does not show that data inside affected customer servers stayed inaccessible.
   • Other Onamae.com services have not been announced as suspended.

   Remediation

   • Immediately change all credentials stored on or used by Desktop Cloud servers, and change any reused passwords on other services.
   • OANDA Japan customers should change My Page and MT4/MT5 passwords, enable two-factor authentication where available, review trading histories and report suspicious transactions to support.
   • Watch for phishing that exploits the incident. GMO says staff never ask for passwords or card data by email or phone.
   • Wait for GMO's further findings and its service resumption announcement.
8. bleepingcomputer.com ↗ · pub. 21/10/2026 18:43 · coletado 21/10 20:00 primeiro registro

   Onamae Desktop Cloud (GMO Internet) breached; malware installed on up to 26,739 customer VPS servers

   ler a análise desta fonte ocultar

   Hackers compromised the infrastructure of Onamae.com Desktop Cloud, a VPS service operated by GMO Internet in Japan, and installed malicious programs on up to 26,739 customer servers. The company confirmed the intrusion on October 20, 2026. It began progressively shutting down customer servers at 04:00 local time on October 21, and all Desktop Cloud plans are affected. The data stored on the impacted servers may have been exposed, but GMO has not confirmed any misuse or leak. Payment data such as credit card details is stored on separate infrastructure and is reportedly unaffected. The service is marketed for FX automated trading with MetaTrader 4 (MT4).

   Technical Details

   • An unauthorized third party gained access to Desktop Cloud infrastructure and installed "unauthorized programs" in some customers' server environments.
   • The article gives no initial access vector, malware family, attribution or IOCs.
   • GMO warns of an increased risk of phishing and other unsolicited communications that exploit the incident.

   Remediation

   • Rotate passwords and other secrets that were stored on Desktop Cloud servers as soon as possible.
   • Treat emails or calls asking for passwords or credit card details as suspicious. GMO says it will never request them by email or phone.
   • No restart date for the service has been given. GMO says it will publish updates as the investigation continues.