Japan's GMO Internet Group is facing hard questions about its own security process after hackers breached its Onamae.com Desktop Cloud, a Windows virtual server service that foreign-exchange traders use to run automated trading programs around the clock. On October 25, group founder and chief executive Masatoshi Kumagai acknowledged that in-house security specialists had identified weaknesses in the service before the intrusion, but that the response lacked sufficient speed and depth. Teams were working on remedies, he said, while concerns about availability and competing priorities slowed an adequate fix.
The breach itself unfolded quickly. A customer inquiry on October 19 prompted an investigation, and on October 20 GMO confirmed malicious programs inside some customers' server environments. At 4 a.m. Japan time on October 21 it began shutting down every server on every plan, eventually taking the entire service offline. GMO says up to 26,739 servers may have been affected, a figure it stresses is the potentially exposed total, not a count of confirmed intrusions.
What made this incident unusually damaging was what lived on those servers. Traders keep tools such as MetaTrader 4 and MetaTrader 5 running continuously on the service, with brokerage login details saved inside the trading software so strategies can operate unattended. On October 22, GMO warned that those login details may have been viewed and misused, as customers began reporting unauthorized operations in their trading accounts. Brokers including OANDA Japan and FXTF issued their own warnings to customers who ran trading software on the service. Japanese broadcasters have documented individual accounts losing millions of yen in seconds through trades the customers say they never authorized, though GMO has not published a verified total for customer losses.
On October 24, in its fourth public report, GMO confirmed that a security problem in its own system had allowed the attackers in and that customer information was taken out of its environment. It also disclosed extortion: a person believed to be the attacker demanded money and threatened to keep placing unauthorized orders in customer accounts at more than 70 securities and foreign-exchange firms in Japan and abroad, to publish customer and company information, and to launch ransomware attacks. GMO says it will not pay, arguing that payment would not guarantee the stolen data is deleted or not misused, and it has handed the evidence to police cybercrime units.
The company's response now includes compensation and a permanent retirement for the compromised platform. Every current customer will receive a flat 5,000 yen payment, separate from compensation for verified realized trading losses and fees caused by unauthorized trades. Ordinary market losses, lost profits and indirect damages are excluded. The old platform will not be restarted; customers who still want a Windows desktop will be offered an alternative service on an independent cloud platform, free for six months. GMO has also asked brokers to block connections coming through the service and force-disconnect active sessions, warning that changing a password alone may not end an attacker's access, because an already authenticated session can stay valid at some brokers.
GMO has additionally asked the government to apply Japan's active cyber defense framework, which took effect on October 1, to track and neutralize the attackers' infrastructure. The practical lessons for enterprise IT are already clear. Always-on hosted desktops concentrate valuable credentials in one place, revoking a password is not the same as revoking a session, and a known weakness left open can become the most expensive item on the backlog. GMO has not yet said how the attackers first got in, and its investigation is continuing.