GMO's Onamae Desktop Cloud breach: trading logins stolen, data leaked, and a $1M bounty instead of a ransom
Quotable summary
GMO Internet, one of Japan’s largest internet companies, has been fighting a breach of Onamae Desktop Cloud (お名前.com デスクトップクラウド) for a week. The service is a hosted Windows desktop that many traders use to run tools like MT4/MT5 around the clock. Attackers planted malicious programs on customer servers and took data stored on them, including trading-account logins saved in those tools. Customers then reported unauthorized trades. GMO says 26,739 servers may be affected, and it shut down every plan on 21 October. The attacker demanded about ¥8 billion (roughly $50M per TechCrunch). On 27 October (JST), GMO confirmed the attacker had published data it claims belongs to GMO and its customers. GMO says it will never pay, warned that visiting the leak site exposes the visitor’s own information to the attacker, and announced a “GMO Cybercrime Bounty” of up to US$1 million for information leading to the culprits. Translation: if you keep broker passwords on a rented desktop, that desktop is now a bank vault, so lock it like one.
What changed
| Item | Detail |
|---|---|
| Victim / service | GMO Internet, Inc., Onamae Desktop Cloud (all plans), a Windows VPS used for FX and stock-trading tools |
| Scope | 26,739 servers potentially affected (GMO 2nd report) |
| Data at risk | Anything stored on the servers, including trading-account logins saved in trading tools (MT4/MT5 etc.). GMO says it doesn’t hold customer payment or card data on these servers |
| Impact reported | Customers report unauthorized operations on brokerage/FX accounts |
| Ransom demand | About ¥8 billion, received 21 Oct (GMO); GMO says it will not pay, ever |
| Leak | Attacker-posted data confirmed 12:30 JST, 27 Oct (10:30 PM CT, 26 Oct). Contents still being verified and may include false material |
| Ransomware | Not observed as of 13:55 JST, 27 Oct (GMO 10th report) |
| Bounty | GMO Cybercrime Bounty: total cap US$1,000,000 across all tipsters. Intake opens 12:00 JST, 28 Oct (10:00 PM CT, 27 Oct) at cybercrimebounty.gmo |
| Customer payments | Flat ¥5,000 already promised, plus loss compensation. New per-category payments if a customer’s data is confirmed leaked: ¥10,000 basic info, ¥15,000 financial/auth info, ¥25,000 sensitive info (cap ¥3M) |
Timeline (JST, per GMO)
| Date | Event |
|---|---|
| 19 Oct | Customer inquiry triggers investigation |
| 20 Oct | Malicious programs confirmed on some customer servers; new sign-ups and control panel stopped |
| 21 Oct 04:00 | All plans shut down; first notice; extortion email (~¥8B) |
| 22 Oct | Police consulted; customers told to change trading passwords from a different device and end sessions |
| 24 Oct | Compensation and replacement service announced; GMO asks government agencies to apply active cyber defense measures |
| 25–26 Oct | GMO staff collect customer PCs nationwide for malware analysis |
| 27 Oct | Customers asked to back up, disconnect and power off PCs ahead of a threatened noon action; leak confirmed; refusal to pay; bounty and new compensation tiers announced |
Why it matters
- “Saved password in a trading tool” is a credential store. The damage path here wasn’t exotic. Malware on always-on hosted desktops harvested logins that were saved in trading software, and those logins were then used to trade. Any VPS or VDI that holds broker, bank or exchange credentials deserves the same controls as a password vault: MFA at the broker, no saved credentials, and session limits.
- The blast radius moved to customer PCs. GMO is now collecting and analyzing customer endpoints and has told customers to power theirs off. That suggests the investigation has moved beyond the hosted servers. GMO hasn’t yet said what, if anything, it found on those devices.
- Don’t click the leak. GMO says the leak site captures visitors’ information. Curiosity clicks by customers, journalists or researchers can create a second set of victims, so leave that to authorized responders.
- A bounty instead of a ransom. GMO is answering the extortion with a public reward for information. It stresses that it isn’t a ransom or a buy-back. It asks tipsters not to hack, buy leaked data or contact the attacker.
- The AI angle is unproven. TechCrunch notes that GMO’s security unit separately reported an AI-enabled Chinese pentest tool called Artex being used against Japanese companies. GMO hasn’t publicly linked Artex to this breach, and neither do we.
FAQ
I used Onamae Desktop Cloud. What should I do now? From a different, clean device, change every password that was saved or typed on the hosted desktop, starting with broker and FX accounts. Log out of all sessions, turn on two-factor authentication where your broker offers it, and check your trade history and balances. GMO’s 24-hour line is +81 3-5456-2560.
Was payment card data stolen? GMO says it doesn’t keep customer payment information, including credit cards, on the Desktop Cloud servers. Data customers stored on those servers themselves is in scope.
Is this ransomware? GMO says it hadn’t seen a ransomware attack as of 13:55 JST on 27 October. This is data theft plus extortion, and GMO is still watching for encryption activity.
How does the $1M bounty work? Tips open at 12:00 JST on 28 October via GMO’s dedicated site. US$1 million is the cap for the whole program, not per tip. Payment depends on verifiable information that helps identify or arrest the people involved. People involved in the crime, or anyone who obtained the information illegally, aren’t eligible.
Sources
| Source | Role | Link |
|---|---|---|
| GMO Internet | Primary: 12th report, refusal to pay, bounty, compensation tiers, timeline | GMO Internet — Onamae Desktop Cloud unauthorized access, 12th report (JA) |
| GMO Internet | Primary: leak confirmation, no ransomware observed, device analysis | GMO Internet — Onamae Desktop Cloud, 10th report (JA) |
| GMO Internet | Primary: scope (26,739 servers), data at risk, initial timeline | GMO Internet — Onamae Desktop Cloud, 2nd report (JA) |
| GMO Internet Group | Primary: group-level notice of 12th report | GMO Internet Group — Alert 2026102705 (JA) |
| TechCrunch | Secondary: English timeline, ~$50M conversion, Artex context | TechCrunch — GMO says hackers posted stolen customer data |