The facts

  1. The intrusion was detected on 20 October. BleepingComputer reported potential exposure involving up to 26,739 customer servers, including possible compromise of MetaTrader credentials and trading-account details. [1]

  2. GMO said the attacker demanded approximately ¥8 billion. It reported publication of purported customer data on 27 October while warning that authenticity remained under examination. [2][4]

  3. As of 18:20 Japan time on 28 October, GMO said analysis of submitted computers had found no traces of malware infection or ransomware attacks. That finding is limited to the machines examined. [4]

  4. On 29 October, GMO said it planned to give police information it believed could help identify the attacker. It did not announce an arrest. [3]

  5. On 24 October, GMO said customer information had been taken and some customers reported trades they did not recognize; the company said confirmed financial losses would be considered separately. [6]

  6. On 30 October, GMO Internet said it had begun contacting contracted customers about a ¥5,000 goodwill payment and a replacement service on separate cloud infrastructure, free for six months; transfer requires customer consent. [5]

Still unconfirmed

  • The full number of compromised customers, authenticity of all purported leaked material and attacker identity remain unresolved.
  • The 30 October notice does not give a launch date for the replacement service or a final count of affected customers.

Corrections & updates

Substantive update, 2 November: added GMO’s 30 October customer-contact, compensation and opt-in replacement-service notice, plus the company’s 24 October account of customer-data exfiltration and reports of unrecognized trades. The 26,739-server figure remains a reported potential exposure, not a confirmed number of compromised customers; authenticity of all posted data remains unresolved.

Sources

References support the numbered facts above. Source checks: 2 Nov 2026, 06:32 UTC.

  1. Japan's GMO urges customers to shut down PCs amid ransomware threat

    BleepingComputer · Reporting · 27 Oct 2026

  2. Onamae Desktop Cloud intrusion: tenth notice

    GMO Internet Group · Primary source · 27 Oct 2026

  3. Onamae Desktop Cloud intrusion: fifteenth notice

    GMO Internet Group · Primary source · 29 Oct 2026

  4. Onamae Desktop Cloud intrusion: fourteenth notice

    GMO Internet Group · Primary source · 28 Oct 2026

  5. Onamae Desktop Cloud: customer contact about compensation and replacement service

    GMO Internet · Primary source · 30 Oct 2026

    Actual company notice opened, dated 30 October. It says contact began with contracted users, describes the ¥5,000 payment and six-month alternative service, and says customer consent is needed for transfer.

  6. Onamae Desktop Cloud intrusion: customer information and service response

    GMO Internet Group · Primary source · 24 Oct 2026

    Actual company notice opened. GMO confirms information was externally taken, describes unrecognized-trading reports and says verified losses would be handled separately.

Report a factual error