GMO Internet's Cloud Service Breach Exposes FX Trading Risks

“a third party had installed malicious programs in the server environments of some customers,” GMO Internet warned — and the consequences have rippled into customers’ trading accounts, company operations, and a wider debate over national cyberdefense.

GMO Internet’s Onamae.com Desktop Cloud — a virtual desktop infrastructure (VDI) service the company markets as an ideal environment for running foreign exchange trading applications — was breached, the company acknowledged. GMO said the attacker installed malicious software into customer server environments and that “systems had security vulnerabilities, that its environment was accessed without authorization, and that customer information was taken outside the Company.” Some customers have reported “unauthorized operations were performed on their trading accounts,” and GMO advised that third parties had probably seen users’ passwords for trading services.

Onamae.com Desktop Cloud: designed for trading, compromised in practice

GMO positions Onamae.com Desktop Cloud as a hosted Windows-desktop environment for FX trading software. After detecting the intrusion, the company told users to “immediately change passwords for their trading accounts,” and to do so from a device they do not use for trading. The company also warned that some trading applications may keep sessions alive even after a password change, and urged users to “check your securities or FX company's guidance or your account page, and either disconnect all active sessions or ask the company's support desk to disconnect them.”

Scale of the incident: 26,739 VDI servers and lingering session risk

GMO reported that investigators have identified as many as 26,739 VDI servers that “may have been hit by the attack.” Beyond lost credentials, GMO warned that users’ personal devices could also be at risk. Because some trading services retain active sessions, the company has asked customers and trading platforms to treat active connections from the Onamae.com Desktop Cloud as potentially compromised.

Extortion, company decisions, and immediate mitigations

The attacker has demanded $50 million, GMO revealed, and reportedly threatened to publish information about the company and its customers if the demand is refused. GMO said it will not pay, explaining “complying would not guarantee that the obtained information is deleted or that its misuse is prevented.”

GMO contacted major trading services and asked them to forcibly terminate all active sessions, monitor for unauthorized transactions, and block trade requests coming from the Onamae.com Desktop Cloud. The company offered impacted users a ¥5,000 ($32) condolence payment and pledged to “make good on any trading losses caused by the attack.” GMO also committed to provide “a free alternative environment for six months,” to “fundamentally overhaul our system infrastructure,” and to conduct a thorough investigation “with the help of external experts.” Investigations into the incident continue.

Masatoshi Kumagai: internal warnings, AI-enabled tools, and a call to government

GMO CEO Masatoshi Kumagai acknowledged the company had known the service’s security “could be improved.” He wrote that “our in-house white-hat hackers had previously pointed out areas for improvement to the team” and that the team “took these points to heart and was working on countermeasures.” But he conceded the response “lacked sufficient depth and speed, allowing the attackers to exploit the vulnerability,” and said he “deeply regret[s]” the failure to turn internal expertise into effective defenses.

Kumagai warned of a changing threat landscape: “The ease with which open weight AI models can be combined and spread into countless attack tools has transformed cyberattacks, which once required advanced skills, into an era where anyone can easily carry them out.” He said GMO Group’s cybersecurity operation “has confirmed that the source of an unauthorized access attack targeting approximately 20 Japanese companies was the misuse of ‘ARTEX,’ an autonomous AI penetration testing tool originally intended for defense.”

He urged a government role, saying GMO “submitted a proposal to the government to ‘apply proactive cyber defense,’” while adding the company was “by no means trying to shift the blame for our company's actions onto the government and beg for a bailout.”

What this means for technologists, trading services, and end users

• Technologists and security teams: review VDI authentication and session-management controls, prioritize fixes formerly flagged by internal testers, and work with external experts as GMO pledged to do.
• Trading services and platforms: follow GMO’s request to terminate active sessions from the Onamae.com Desktop Cloud, monitor accounts for unusual transactions, and block trade requests originating from the compromised environment.
• End users of Onamae.com Desktop Cloud: change trading passwords immediately using a device not used for trading, check account pages or company guidance, and ask brokers to disconnect active sessions.

The investigation is ongoing, and GMO has framed this breach as both a technical failure and a symptom of broader risks tied to emerging attack tools. For affected customers the immediate tasks are operational: change credentials, sever sessions tied to the VDI, and reconcile account activity. For GMO, the company has promised remediation, compensation for trading losses, and a six‑month migration path — steps that, if completed, will be judged against the scale of the exposure it has disclosed.

Original reporting: https://www.theregister.com/security/2026/10/27/japanese-virtual-desktop-cloud-hacked-so-hard-it-asks-to-be-banned/5305610