GMO Unauthorized Access: Onamae.com Breach Explained

The GMO security incident trending in Japan is a breach of Onamae.com Desktop Cloud (お名前.com デスクトップクラウド). The cloud desktop service is run by GMO Internet, Inc. and is used mainly by retail investors to run automated foreign-exchange (FX) trading software. An attacker planted malicious programs on customer servers, trading-account logins stored on them may have been stolen and misused, and the attacker is now demanding a ransom that GMO says it will not pay.

As of October 26, 2026, GMO says up to 26,739 servers may be affected. It has confirmed that customer information was taken out of its systems and has promised compensation. It has not said how the attackers got in, and no link has been confirmed to the critical PHP vulnerability also trending this week.

Which GMO company was hit?

The affected company is GMO Internet, Inc., listed on the Tokyo Stock Exchange Prime market (code 4784). It is a consolidated subsidiary of GMO Internet Group (code 9449), which filed a stock exchange disclosure on October 23. The full disclosure document names the service and summarises the first three incident reports.

GMO Internet first announced the unauthorized access on October 21 in a corporate news release and an Onamae.com service notice. The notices cover only the Desktop Cloud service. GMO has not said that other Onamae.com products, such as domain registration, are affected.

Customers rented Windows desktop servers, a type of virtual private server (VPS), to run trading tools such as MetaTrader 4 and 5 (MT4/MT5). Business+IT reports that more than 20,000 investors used the service.

What was accessed?

According to GMO's third report, the data at risk is whatever customers stored on the affected servers. That includes trading-account login details saved inside trading tools. GMO says it does not keep payment data, including credit card numbers, on these servers.

• Unauthorized trades: Customers reported trades they had not made, the second report said. NHK reported the same on October 23.
• Data taken out: In its fourth report on October 24, GMO said the service had a security problem and confirmed that customer information had been removed from its systems.
• Customers' own devices: The fifth report said the investigation now includes possible effects on customers' PCs and phones.

Tokyo Sports, citing an unnamed IT source, reported that the attackers could reach customers' PCs and had released samples such as pay slips. GMO has not confirmed this, and it warns that any leaked material may contain false information.

How many users are affected?

GMO's figure is 26,739 servers that could be affected across all plans. The company stresses this is the number of servers at risk, not a confirmed count of break-ins or data theft. The attacker reportedly claims to hold credentials for about 140,000 accounts, according to Tokyo Sports. That claim is unverified.

Timeline of the GMO breach

Times are Japan Standard Time (JST, UTC+9), taken from GMO's reports and NHK.

• Oct 19: A customer inquiry prompts GMO Internet to investigate.
• Oct 20: GMO confirms malicious programs on some customer servers and suspends new sign-ups and the control panel.
• Oct 21, 04:00 JST (Oct 20, 19:00 UTC): Servers on all plans begin shutting down, and the first notice is published.
• Oct 22: GMO consults the police and issues a second report.
• Oct 23: Third report, the parent company's disclosure, and NHK coverage.
• Oct 24: Fourth and fifth reports confirm data was taken out, reveal the extortion, and announce compensation.
• Oct 25: Group CEO Masatoshi Kumagai explains the company's position in a blog post.
• Oct 26: A sixth report repeats security steps, and NHK reports a ransom deadline.

The ransom demand and GMO's refusal

GMO's fourth report says the apparent attacker demanded money and threatened three things. They would keep manipulating customer accounts at more than 70 brokerages and FX firms in Japan and abroad. They would leak data from the service and connected PCs and launch ransomware. And they would publish information about GMO's own systems. GMO refuses to pay because payment would not guarantee the data is deleted or left unused, and it has given evidence to police.

Reports differ on the amount. NHK reported on October 26 that a hacker group wants US$1 million (more than ¥157 million) by noon on October 27 JST (03:00 UTC). It said the group is also threatening customers. An October 26 update to Kumagai's blog lists a demand for US$50 million (about ¥8 billion). GMO has not explained the difference.

Some customers are unhappy. Tokyo Sports quoted users who want GMO to pay, and others who called the goodwill payment too small given what may have leaked.

GMO's compensation offer

Under the fourth report and Impress Watch's summary, GMO is offering:

• ¥5,000 to every user (about US$32 at the roughly ¥157-per-dollar rate implied by NHK's October 26 conversion), whether or not they lost money. Details are due by email by 23:59 JST on October 30.
• A replacement service on a separate cloud platform, free for six months, for users who want it.
• Cover for realized losses from confirmed unauthorized trades, including fees. GMO pays what an exchange or broker does not refund, or the full eligible amount if they refuse. Market-movement losses, lost profits and indirect damage are excluded. The claims process is due by November 6.

Kumagai wrote that the ¥5,000 is only a first gesture, not a final settlement.

GMO's request for "active cyber defense"

GMO has asked the government to make this the first case under Japan's new active cyber defense framework. Under that framework, the state could trace and neutralize the attackers' servers. Impress Watch explains that the law took effect on October 1, 2026, and covers critical-infrastructure operators in 15 sectors. GMO Internet Group is not one of them.

Business+IT reports that government officials said the system is not designed to be triggered at a single company's request. In his blog, Kumagai argued that real-world harm to citizens should count more than formal categories. He also wrote 「決して自社の責任を国に転嫁し、救済を懇願しているわけではありません」 ("we are by no means shifting our responsibility to the state or begging for rescue").

Kumagai also admitted that GMO's own white-hat hackers had flagged security issues in the service beforehand, but fixes came too slowly.

Is the GMO breach linked to the PHP vulnerability?

As of October 26, 2026, there is no confirmed link. The PHP project published fixes for two critical remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, on October 21 at 14:00 UTC (23:00 JST), according to php.net. Our PHP vulnerability explainer covers those in detail.

• None of GMO's six reports names how the attackers got in.
• GMO found the malicious programs on October 20, the day before PHP's public fix.
• Kumagai's blog mentions a serious PHP flaw only as an example of how quickly AI-driven attacks now spread, not as the cause of this breach.
• Tokyo Sports' IT source said the GMO case should be treated separately from the PHP issue.

What Onamae.com Desktop Cloud users should do

This is general information drawn from GMO's notices, not personal advice. Follow the latest official notice and your broker's instructions.

1. From a different, safe device, change passwords for your trading accounts and trading tools.
2. Log out of all active sessions, even after changing passwords. Ask your broker to cut sessions if needed.
3. Check your trade history and balances. Report unfamiliar trades to your broker first.
4. Turn on two-factor authentication wherever it is offered.
5. Change any password stored on the server or reused elsewhere, including passwords saved in your browser.
6. Run a full antivirus scan on PCs and phones that connected to the service, and back up important files offline.
7. Ignore messages from anyone claiming to be the attacker or offering to recover lost money for a fee. GMO says it will never ask for passwords or authentication codes.

GMO's support line is +81-3-5456-2560, open 24 hours, and its contact form is at help.onamae.com.

Our take

GMO has published regular, detailed updates and an unusually generous loss guarantee. But its CEO's admission that internal warnings went unaddressed weakens its case for state help. The two different ransom figures and the unverified 140,000-account claim show how much is still unclear. Until GMO names the entry point, claims linking this breach to any specific vulnerability are guesswork.

What to watch next

• Whether the attackers act after the October 27 noon JST deadline NHK reported.
• Emails about the ¥5,000 payment and the replacement service, due by October 30.
• The loss-claims process, due by November 6.
• How the government responds to the active cyber defense request.
• GMO's findings on the entry point and the financial impact, which the parent company says it is still assessing.

Frequently asked questions

Which GMO service was hacked?

The breach hit Onamae.com Desktop Cloud (お名前.com デスクトップクラウド), run by GMO Internet, Inc., a subsidiary of GMO Internet Group. It is a cloud desktop service used mainly to run automated FX trading tools such as MT4 and MT5.

How many GMO customers are affected?

GMO says 26,739 servers could be affected, though that is not a confirmed count of break-ins. Business+IT reports more than 20,000 investors used the service. Tokyo Sports reported an unverified attacker claim to hold credentials for about 140,000 accounts.

Will GMO pay the ransom?

No. GMO says paying would not guarantee the stolen data is deleted or not misused, and it has given evidence to police. NHK reported a US$1 million demand with a noon October 27 JST deadline, while the CEO's blog lists a US$50 million demand.

What compensation is GMO offering?

GMO is paying ¥5,000 to every user, offering a free replacement service for six months, and covering realized losses from confirmed unauthorized trades that exchanges or brokers do not refund. Claim instructions are due by November 6, 2026.

Is the GMO breach caused by the PHP vulnerability?

As of October 26, 2026, there is no confirmed link. GMO has not disclosed how attackers got in, and it found the malicious programs on October 20, a day before PHP published fixes for its critical flaws on October 21.

Sources

1. 連結子会社の提供サービスへの不正アクセスに関するお知らせ (Notice on unauthorized access to a subsidiary's service), GMO Internet Group
2. Timely disclosure PDF, October 23, 2026 (unauthorized access to Onamae.com Desktop Cloud), GMO Internet Group
3. Notice of unauthorized access to Onamae.com Desktop Cloud, first report (Oct 21, 2026), GMO Internet (Onamae.com)
4. Notice and apology regarding unauthorized access to Onamae.com Desktop Cloud (Oct 21, 2026), GMO Internet
5. Onamae.com Desktop Cloud unauthorized access, second report (Oct 22, 2026), GMO Internet Group
6. Onamae.com Desktop Cloud unauthorized access, third report (Oct 23, 2026), GMO Internet Group
7. Onamae.com Desktop Cloud unauthorized access, fourth report (Oct 24, 2026), GMO Internet Group
8. Onamae.com Desktop Cloud unauthorized access, fifth report (Oct 24, 2026), GMO Internet Group
9. Onamae.com Desktop Cloud unauthorized access, sixth report (Oct 26, 2026), GMO Internet Group
10. 今こそ官民連携で日本を守ろう――能動的サイバー防御を具申した理由 (Why we proposed active cyber defense), Masatoshi Kumagai (GMO Internet Group CEO) blog
11. GMO FX取引のサーバーに不正アクセス 口座で不正操作の相談も (Unauthorized access to GMO FX trading servers), NHK
12. ハッカー集団 GMOにあす期限で100万ドル要求 顧客脅迫も (Hacker group demands $1 million from GMO by tomorrow), NHK
13. 不正アクセスを受けたGMOに金銭要求 政府に「能動的サイバー防御」要請 (Money demanded from GMO; active cyber defense requested), Impress Watch
14. 不正アクセス被害のGMO「能動的サイバー防御」を要請も、現行法制度では限界か (GMO's active cyber defense request and legal limits), Business+IT (SB Creative)
15. 不正アクセス受けたＧＭＯに高まる不信感 (Growing distrust of GMO after unauthorized access), Tokyo Sports
16. PHP: Hypertext Preprocessor (news and security advisories, October 2026), The PHP Group

How we wrote this

GessyMorgan explainers are built from public reporting and official sources. This post draws on the 16 sources listed above, each linked where we use it. It was drafted with AI assistance and checked against those sources before publishing. We did not test products, attend events or interview anyone for this article. Facts are current as of October 26, 2026, and we update the post when they change.