GMO Internet Group has formally requested that Japanese state agencies exercise their newly established cyber defence authority in response to a significant breach targeting its Onamae.com Desktop Cloud service. This cyberattack compromised thousands of servers used by forex traders and led to unauthorized trades and ransom demands.
- Hackers breached GMO’s Onamae.com Desktop Cloud, affecting thousands of trading servers.
- GMO requests government use of new cyber defence powers to disrupt attackers’ infrastructure.
- Company compensates customers and suspends the affected service amid ongoing police probe.
What happened
GMO Internet Group disclosed a cyberattack targeting its Onamae.com Desktop Cloud service, which rents Windows servers to traders running automated forex tools like MT4 and MT5. Malicious software implanted by intruders exposed trading credentials stored on the servers, allowing unauthorized trading activity from October 21 onward. Up to 26,739 servers may have been compromised, impacting customer accounts both domestically and internationally.
The hackers demanded payment and threatened to continue unauthorized trades, leak sensitive customer and corporate data, and launch ransomware attacks. GMO refused to meet the ransom demands, citing the risk that payment would not guarantee erasure or cessation of data misuse. Instead, the company has asked law enforcement to open a criminal investigation and called on brokerage platforms to block access from the compromised service.
Why it matters
This incident marks the first request by a private company for Japan’s government to apply the newly enacted active cyber defence law, which allows police and the Self-Defense Forces to actively trace, block, and neutralize external cyberattacks by disabling attacker infrastructure. The law came into effect on October 1, prompted by a surge in domestic cyber incidents.
Although GMO is not designated as a critical infrastructure operator under the statute — limiting some of the law’s direct applications — the company's call highlights the need for more agile and assertive state involvement in combatting sophisticated cyber threats. The breach also underscores vulnerabilities in fintech cloud services supporting retail and institutional traders.
What to watch next
GMO has committed to compensating current customers ¥5,000 (approximately $32) each, regardless of losses incurred, and will reimburse any realized financial damage from unauthorized trades minus any brokerage refunds. It will shut down the compromised Onamae.com Desktop Cloud service and offer a free six-month migration to an alternative service for affected users.
Authorities’ response to GMO’s request for active cyber defence intervention will be closely monitored, as it may set a precedent for broader government involvement in private sector cyber incidents. GMO plans to publish a detailed claims process by November 6, while the financial impact on its earnings remains uncertain.