Japan's GMO Internet Cyberattack Puts 26,739 Servers at Risk as Company Promises to Cover Verified Trading Losses

A Trading Service Built to Run Around the Clock Is Now Switched Off

Automated currency trades were meant to run quietly in the background for customers of GMO Internet's Onamae.com Desktop Cloud service.

Instead, attackers broke into the servers behind the platform, stole customer login details and used them to place unauthorised trades.

The Japanese internet group has confirmed the breach and taken the entire system offline while it establishes how far the damage goes.

How Did the Breach Come to Light?

The alarm was raised on 19 October 2026, when a customer contacted GMO with a query.

By 20 October, investigators had found malicious software running inside customer server environments on Onamae.com Desktop Cloud.

The service lets people run automated foreign exchange (FX) programmes, including MetaTrader 4 and MetaTrader 5, without keeping their own computers switched on.

The same servers also held customers' brokerage credentials, which gave anyone who got inside direct access to trading accounts.

GMO began powering down servers at 4am Japan time on 21 October and later took the entire service offline.

It has since identified a flaw in its own systems that allowed unauthorised access and the removal of customer data.

What Happened to Customer Accounts?

Affected users report losses that built up within minutes.

One account lost around 2.4 million yen (about US$15,400) in roughly 84 seconds through a rapid series of trades.

GMO says customer information, including account passwords, was leaked and used in fraudulent transactions.

It has not disclosed the total value of the losses.

The company says 26,739 servers may have been affected.

That figure refers to servers that were potentially exposed, not confirmed infections.

An early report carrying the number offered no technical detail to support it.

Why Are Attackers Threatening More Than 70 Brokerages?

GMO says it received a demand for money, accompanied by a threat to carry out further unauthorised activity on customer accounts at more than 70 securities and FX brokerages in Japan and abroad.

The attackers also said they would publish the stolen information and launch more ransomware attacks if they were not paid.

GMO refused, arguing that paying would not guarantee the stolen data would be deleted or that the attacks would stop.

The company has consulted police, submitted evidence and engaged outside cybersecurity specialists.

No known criminal group or state-backed campaign has been linked to the attack, and the identity of those responsible remains unestablished.

Did GMO Ignore Warnings From Its Own Engineers?

In a blog post on Sunday night, GMO Internet Group founder and CEO Masatoshi Kumagai admitted that in-house white-hat hackers had flagged security weaknesses before the breach.

He said the company's response was inadequate in both depth and speed, and that the attackers exploited the gap.

He wrote,

"I deeply regret it.”

He also warned against treating the incident as a private-sector matter alone.

Kumagai said,

"If this is overlooked as just an isolated incident in the private sector, all kinds of social infrastructure and personal assets could be threatened next by similar methods."

What Is GMO Offering Affected Customers?

On 24 October 2026, GMO announced a package of support measures.

Every Desktop Cloud customer will receive a flat 5,000 yen (about US$32), whether or not they lost money.

The company will also reimburse verified losses from unauthorised trading, along with related fees, and will give affected customers six months of free access to an alternative desktop platform.

The compromised infrastructure remains offline.

Investigators are still working to determine how many accounts were affected and the final financial damage.

Why Has GMO Asked the Government to Step In?

GMO has made an urgent request for Japan to use its active cyber defence powers.

Since 1 October 2026, the Self-Defence Forces and police have been able to break into an attacker's servers in advance to neutralise them and prevent harm.

The company said that private firms acting alone can hardly eradicate highly skilled cybercrime groups that steal people's assets, and Kumagai asked the government to help neutralise the threat.

What Is GMO's Background in Digital Finance?

GMO Internet Group entered cryptocurrency during bitcoin's surge in 2017, launching GMO Coin in May of that year.

The exchange later gained regulatory registration and added ethereum, bitcoin cash, litecoin and XRP trading.

In September 2017, the group unveiled plans for renewable-powered bitcoin mining in Northern Europe, its own 7-nanometre mining chips and cloud mining services.

It also paid some employees in bitcoin that year.

The mining venture proved costly.

GMO recorded about 35.5 billion yen (around US$227 million) in restructuring-related losses in 2018 as falling crypto prices hit mining profits.

The group continued to build its digital asset business through GMO Coin, adding lending, staking, margin trading and token offerings, and explored stablecoins, blockchain projects and investments in emerging crypto businesses.