Japan’s tech giant GMO Internet is embroiled in a major cybersecurity incident after confirming hackers have published customer data linked to its Onamae cloud desktop platform, a service used by financial traders. The company suspects unauthorized access to Onamae systems and says it’s still validating the contents and the full scope of the breach. It has urged clients to reset passwords and disclosed mounting reports of illicit activity in affected trading accounts.
What Happened and What We Know
The breach first came to light on October 21, when GMO Internet shut down Onamae Desktop Cloud after it discovered signs of a system compromise. That same day, the attackers demanded a ransom of about 8 billion yen (roughly US$50 million). By October 22, the company reported the incident to Japanese authorities and issued a public update, pledging compensation and substitute services. On October 24, it officially began offering these alternatives, and over the next two days, it asked customers to submit devices for forensic analysis. By October 27, claims of exposed data—possibly that of both GMO and its clients—surfaced, though their authenticity remains under investigation.
Extent, Possible Root Cause, and Regulatory Response
GMO estimates that up to 27,000 servers might be involved in the breach. The company explicitly acknowledged reports of unauthorized trading operations at customer accounts, prompting the password reset advisory. While the origin of the breach remains uncertain, there may be a connection to recent activity involving a China-based AI-powered penetration testing tool called Artex, which has been tied to similar attacks in Japan and South Korea. GMO has yet to confirm a direct link to this tool in the Onamae breach.
Japan’s Financial Service Agency, following advice from its cybersecurity unit, had earlier warned financial institutions to bolster their defenses including improved incident preparedness, defense-in-depth strategies, and stronger vulnerability management. The agency is now closely monitoring GMO’s response to the breach.
GMO Internet is still working with authorities to determine how extensive the damage is and what information was compromised. For customers, the immediate action items are to change passwords, watch for suspicious account activity, and follow any guidance from the company’s investigative team.
This breach exposes a troubling gap in cloud service security, especially for platforms serving financial markets. As regulators and firms brace for more AI-enabled attacks, this case will be watched carefully—not just for what it reveals about Onamae’s defenses, but as a cautionary tale for cloud providers globally. Key areas to observe include the conclusions of the forensic investigation, any misuse of exposed data, and whether Artex or similar tools are more deeply at play behind these intrusions.
