GMO Internet Confirms Hackers Published Stolen Customer Data After Cloud Service Breach
GMO Internet is still verifying data allegedly published after the Onamae Desktop Cloud breach, while urging customers to reset passwords following unauthorized trading-account activity. The service may involve 27,000 servers, and attackers demanded ¥8 billion.
Japanese internet company GMO Internet confirmed on October 27, 2026, that suspected hackers have published information linked to its customers and business following a breach of its Onamae Desktop Cloud service — a virtualized desktop platform used by financial traders.
The company said it is still verifying whether the posted data is genuine. GMO Internet has advised all customers to reset their passwords after receiving reports of unauthorized activity on customer trading accounts. The company estimates that 27,000 servers may be affected.
The breach unfolded over the course of the week. On October 21, GMO Internet shut down the Onamae Desktop Cloud service after detecting unauthorized access and receiving a ransom demand of approximately 8 billion yen (around $50 million). The company reported the incident to Japanese police the following day. By October 24, GMO said it would offer customers compensation and alternative services, and by October 25–26, the company began collecting customer devices to scan for malware and assess the damage.
The incident follows a separate report by GMO Internet’s cybersecurity unit, which found evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in cyberattacks targeting companies across Japan. GMO said it has not publicly established a connection between Artex and the Onamae breach. According to a CrowdStrike report, Artex was also used in attacks on financial institutions in South Korea in September 2026, with those attacks exploiting weak security controls such as the absence of multi-factor authentication. Reuters reported that Artex’s developer has since stopped public updates and made the tool closed-source.
Japan’s Financial Services Agency told TechCrunch it issued guidance in May urging financial institutions to strengthen cybersecurity defenses, including vulnerability management and incident preparedness. GMO Internet did not respond to a request for comment.