Breach · · 4 min read
GMO Desktop Cloud breach: attackers publish what they claim is customer data
GMO Internet says attackers took customer information from Onamae.com Desktop Cloud, a service many use for trading, and on October 27 posted what they claim is that data.
GMO Internet, one of Japan’s largest web hosting companies, is dealing with a serious attack on “Onamae.com Desktop Cloud,” a cloud desktop service that NHK says is mostly used for currency trading. Customer information was taken, some customers saw trades they didn’t make, and on October 27 the attackers published what they claim is customer data after GMO refused to pay. If you use this service, here’s what is known and what GMO is asking you to do.
What happened
GMO’s fourth report lays out the timeline. It began investigating on October 19, 2026, after customer inquiries, and confirmed the next day that a malicious program had been installed. On October 21 it started shutting down the servers for every plan. GMO says the service had security vulnerabilities, that its environment was accessed without authorization and that customer information was taken outside the company. Some customers have reported transactions in their trading accounts that they don’t recognize.
GMO says the attacker demanded money and threatened to keep placing unauthorized orders in customers’ trading accounts, publish information about customers and their connected PCs, and launch ransomware attacks. GMO says it won’t pay, because paying wouldn’t guarantee the data is deleted, and it is working with the police.
In its tenth report, GMO says that at 12:30 Japan time on October 27 it confirmed the attackers had published what they claim is information about the company and its customers. GMO is still checking it and warns it may contain false information. As of 13:55 that day, it had not confirmed any ransomware attack. NHK reports that the published data’s authenticity hasn’t been confirmed.
For current customers, GMO has announced a flat ¥5,000 payment, and compensation for confirmed losses from unauthorized trades. It says it will publish the claim process by November 6.
What this means for you
This one is more serious than a typical leak of contact details. If you used the service, treat anything you used on that cloud desktop, especially trading logins, as possibly exposed. GMO is also checking whether the PCs that connected to it were affected. Scammers are also likely to use the incident as cover, for example with offers to “recover your losses” for a fee.
What you can do
GMO’s list of requests is the place to start:
- Don’t visit or share the published data. GMO warns that the attackers collect information about everyone who visits that site.
- Run a full antivirus scan (not a quick scan) on the PCs and phones you used to connect, and back up your important files to an external drive while it’s offline.
- From a different, clean device, secure your accounts. Sign out of all sessions, change the passwords for your trading, email and Google accounts, turn on two-step sign-in, and remove any linked apps, mail forwarding, extensions or devices you don’t recognize. Leave browser sync off until you’ve finished.
- Contact your broker or exchange about any trade you didn’t make.
- Never share a password or code. GMO says it will never ask for them, and you should ignore anyone who offers to recover your money for a fee. GMO’s 24-hour line is +81-3-5456-2560.
Our guide to how infostealers steal sessions explains why signing out everywhere matters as much as a new password.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves, and we won’t look at the published data either.
Sources
- GMO Internet, Notice and Apology Regarding Unauthorized Access to “Onamae.com Desktop Cloud” (Fourth Report), October 24, 2026
- GMO Internet, Renewed Request to Customers Using “Onamae.com Desktop Cloud” (Sixth Report), October 26, 2026
- GMO Internet, Current Response to Unauthorized Access to “Onamae.com Desktop Cloud” (Tenth Report), October 27, 2026
- NHK World-Japan, Hackers release data after GMO ignores ransom demand, October 27, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.