GMO confirms Onamae Desktop Cloud data theft, sets 30 October notice

GMO confirms Onamae Desktop Cloud data theft, sets 30 October notice

27 October 2026: GMO Internet has confirmed that customer information was taken from its Onamae.com Desktop Cloud service, a hosted Windows desktop used mostly to run automated currency trading, and that some customers have reported trades on their brokerage accounts that they did not make. It is paying every current customer a flat 5,000 yen, offering six months free on a replacement service and promising to cover realised losses from unauthorised trades, with details due by email before 23:59 on Friday 30 October.

Not yet independently verified. Everything here comes from GMO Internet's own notices. We have not seen whether the threatened attack at noon on 27 October took place, and no government statement on GMO's request for active cyber defence has been read. We will update this when it can be confirmed, and remove this note.

The company's eighth notice, published on the morning of 27 October, says the attacker announced that it would publish customer information and launch a ransomware attack at 12:00 that day, Japan time. GMO asked customers to run a full antivirus scan, back up their data, then disconnect their PCs from the network, switch them off and unplug them before noon.

From a shutdown to confirmed theft

When the service was stopped on 21 October, GMO said up to 26,739 servers might be affected and that it had found no leak of personal data. Its fourth notice, on 24 October, went further: its investigation had found a security problem in the service's own systems, unauthorised access to the environment and confirmation that customer information had been carried out. The same notice says the attacker threatened continued manipulation of customer accounts at more than 70 securities and currency trading firms in Japan and abroad, publication of data on the service and on connected customer PCs, and publication of details of GMO's own systems.

GMO's timeline adds that a threatening email demanding about 8 billion yen arrived on 21 October. The company says it will not pay, because payment would not guarantee the data is deleted or left unused, and that it has handed its evidence to the police cyber crime unit. It has asked brokers to block access from the service, force-close active sessions and monitor for fraudulent orders.

The compensation on offer

• 5,000 yen to every current customer, whether or not they lost money, paid separately from any loss compensation.
• A move to a replacement Windows desktop service on a separate cloud platform, free for six months, only with the customer's consent; GMO will not restart the breached platform as it was.
• Compensation for realised trading losses and fees from trades GMO accepts were caused by the intrusion, less anything a broker refunds; market losses and lost profits are excluded. Customers are asked to contact their brokers about cancelling the trades, and GMO will publish the claim procedure, documents and deadlines by 6 November.

GMO warns that it will never ask for passwords or authentication codes, and that offers to "recover lost money" for a fee are scams.

A first request for active cyber defence

GMO has also asked Japanese government bodies to treat the case as the first use of active cyber defence, the framework under which the state can trace and neutralise attacker infrastructure before damage spreads. It describes attacks on ordinary people's brokerage accounts as beyond what a private company can stop alone. Its white-hat team is analysing customer PCs collected around the country since 25 October, and Trend Micro and other security and AI companies have offered help. Our earlier report covered the shutdown of all servers on 21 October.

Related on TrustList:

• Windows 11 26H2 turns Windows settings backup on by default: review the policy if you have left it “Not Configured”

Sources

• Onamae.com: unauthorised access to Onamae.com Desktop Cloud, current response (8th report), 27 October 2026
• Onamae.com: cyber attack on the Onamae.com Desktop Cloud service (4th report), 24 October 2026
• Onamae.com: current response (7th report), 26 October 2026
• Onamae.com: first report of unauthorised access, 21 October 2026