GMO says hackers posted data after Onamae breach

GMO Internet is probing a possible leak tied to its Onamae cloud desktop service after unauthorized access, password reset alerts and suspicious trading activity.

Japanese internet company GMO Internet is investigating a possible data leak after suspected unauthorized access to its Onamae cloud desktop service, which is used by financial traders. The company says an attacker appears to have posted information linked to its customers and business, though the material is still being checked and the full scope of the incident remains unclear. That uncertainty matters because the service is tied to trading activity, where account misuse can have immediate consequences.

The incident has drawn added attention because GMO had already told users to reset their passwords after reports of unauthorized activity on trading accounts. The company has also said as many as 27,000 servers may be affected. According to IT-PUB News, GMO is now dealing at once with alleged leaked data and signs of account misuse.

GMO is still checking whether the leaked data is genuine

In a blog post, GMO Internet said it believes a suspected attacker published information that may be connected to the company and its customers. So far, the firm has not confirmed that the material is authentic, and it has not specified exactly what may have been exposed.

That leaves customers with a difficult picture. There is still no full confirmation of the leaked material, but the combination of a possible data exposure and suspicious account activity raises the stakes for users who rely on the service for financial trading.

A spokesperson for GMO Internet did not respond to TechCrunch’s request for comment.

Password reset warnings followed suspicious trading activity

GMO Internet advised customers to reset their passwords after receiving reports of “unauthorized operations” on customer trading accounts. The company did not give further detail on what those operations involved.

Onamae’s cloud desktop service provides virtualized desktops for financial traders, so a security problem in the system can directly affect account access and user safety. Even without a confirmed full breach, claims of leaked data alongside suspicious account activity have made the incident especially sensitive.

The company also said the breach may affect 27,000 servers, suggesting the problem could extend beyond a single isolated system.

GMO shut the service down after a ransom demand

GMO Internet’s timeline shows the company had already taken the service offline before its latest update about the alleged leak.

On October 21, it shut down the Onamae Desktop Cloud service after discovering unauthorized access to its systems. GMO also said it received an email from hackers demanding about 8 billion yen, or roughly $50 million.

The next day, October 22, GMO reported the incident to Japanese police and issued another public update. Two days later, on October 24, it said it would offer customers compensation and an alternative service while seeking help from government agencies.

Between October 25 and 26, the company began collecting devices from customers to detect malware and better understand the damage. Then, on October 27, GMO said a suspected attacker had posted information that appeared linked to the company and its customers, while stressing that it was still verifying whether the material was authentic.

The breach comes as Japan faces broader cyber pressure

The case surfaced about a week after GMO Internet’s cybersecurity unit separately said it had found evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan. GMO has not publicly established any connection between Artex and the Onamae breach.

Artex has also been linked to attacks on financial institutions in South Korea in September, according to a CrowdStrike report cited earlier this month. Those attacks reportedly relied on weak security controls, including a lack of multi-factor authentication. Reuters also reported that Artex’s Chinese developer stopped public updates and made the tool closed-source after it was linked to cyberattacks targeting banks.

Japan’s Financial Service Agency has already been urging stronger defenses. A spokesperson told TechCrunch that the regulator issued guidance in May warning financial institutions to prepare for a rise in cybersecurity vulnerabilities.

The agency called for better basic protections, including vulnerability management, defense-in-depth and incident preparedness, while also encouraging firms to use AI and other security tools.

For customers, the immediate issue is whether account information or related business data was exposed and whether any trading activity was affected. For GMO, the pressure now is to define the scope of the breach, limit further damage and restore trust in a service used in a sensitive financial setting.