GMO Hack Fails to Rattle Japan’s Retail Traders as Data Leaks Online

WHO:

Bloomberg Markets - Takayuki Tominaga of Central Tanshi FX said Japan’s retail foreign-exchange market had largely shrugged off the cyberattack on GMO Internet Group Inc.

TechCrunch - GMO Internet was verifying customer data allegedly posted online by suspected hackers.

BleepingComputer - The attack involved GMO Internet Group and its Onamae Desktop Cloud service; GMO worked with Trend Micro on recovery.

BleepingComputer - GMO said it would not pay the attackers’ ¥8 billion ($50 million) ransom demand and would compensate each customer ¥5,000 ($30).

WHAT:

Bloomberg Markets - Retail FX trading volumes held up after the cyberattack, although some investors were closing accounts.

TechCrunch - Suspected hackers posted alleged customer data following a breach of GMO’s cloud service; GMO was checking whether the data was authentic.

BleepingComputer - GMO confirmed that company and customer data had been published online. It said payment information was not exposed, but MT4/MT5 credentials and trading-account details might have been exposed or compromised.

BleepingComputer - GMO said it would consider additional financial compensation for customers whose information was exposed.

BleepingComputer - GMO warned that it would take legal action against people and media outlets that disseminated the exposed information.

BleepingComputer - No ransomware was activated on customer machines, and the attacker appeared not to have carried out that threat.

WHERE:

Bloomberg Markets - The affected retail foreign-exchange market was in Japan.

BleepingComputer - Onamae Desktop Cloud is a virtual private server provider in Japan operated by GMO Internet.

WHEN:

BleepingComputer - GMO said it detected an intrusion on October 20 that might have installed malware on up to 26,739 customer servers.

BleepingComputer - On October 26, GMO warned that threat actors planned to leak customer information and trigger ransomware planted during the attack.

BleepingComputer - The following day, GMO told customers to disconnect and shut down their PCs and unplug cables before noon.

WHY:

BleepingComputer - GMO issued the shutdown instructions to reduce the risk of ransomware activation on customer systems.

HOW:

BleepingComputer - GMO shut down affected servers and reduced service availability while investigating. It scanned customer systems for remaining malware and offered equivalent PC replacements to customers whose computers were damaged.

BleepingComputer - GMO advised: “Once you have a backup, disconnect the network, power it down, and unplug the cord that connects to your PC.” It also urged customers to reset passwords and terminate active sessions.

(UPDATED October 28, 2026 10:01 UTC)

GMO Internet confirmed that company and customer data from its Onamae Desktop Cloud service was posted online after a cyberattack, and warned that trading-account details and MT4 or MT5 credentials may have been exposed, though payment information was not. The company detected the intrusion on October 20, shut down affected servers, worked with Trend Micro to investigate and recover, and urged customers to disconnect and power down their computers while resetting passwords; no ransomware was activated on customer machines. GMO rejected an ¥8 billion ransom demand and said it would pay each customer ¥5,000, while Japan’s retail foreign-exchange trading volumes largely held up despite some investors closing accounts.