GMO Internet discovered an intrusion in its Onamae.com Desktop Cloud service after a customer inquiry on Oct. 19, 2026, and confirmed malicious software in customer server environments by Oct. 20. It began shutting down servers on Oct. 21 and took the service offline. The company identified a flaw in its systems that allowed unauthorized access and removal of customer information.
GMO said 26,739 trading servers were potentially exposed, not confirmed infected; the total financial damage remains undetermined. Attackers threatened further unauthorized activity in customer accounts at more than 70 brokerages unless GMO paid, but the company refused. On Oct. 24, GMO announced a 5,000-yen payment for every existing Desktop Cloud customer and compensation for verified unauthorized trading losses and associated fees. The service remained offline while investigators assessed the breach.
