The GMO cloud attack potentially exposed 26,739 customer server environments and led to reports of unauthorized trading, as Japan’s GMO Internet refused a cryptocurrency ransom demand initially worth approximately $50 million.

Key Takeaways

  • The server count represents potentially affected environments, not confirmed compromises.
  • GMO is verifying information published by people believed to be the attackers.
  • The company has pledged compensation for confirmed trading losses and a separate ¥5,000 customer payment.

What happened in the GMO cloud attack

GMO began investigating on October 19, 2026, after a customer inquiry. It confirmed the following day that malicious software had been installed in some customer server environments and began shutting down all plans of its Onamae.com Desktop Cloud service at 4 a.m. Japan time on October 21.

The service lets traders run software, including MetaTrader 4 and MetaTrader 5, continuously on remote machines. Credentials and other information stored in those environments may have been accessible to the attackers. GMO subsequently confirmed that customer information had been removed from its systems and said customers had reported unauthorized transactions in their trading accounts.

Ransom refusal and published information

The initial demand was approximately $50 million, or roughly ¥8 billion, with payment requested in Bitcoin and Ethereum. GMO said it would not pay because doing so would not guarantee that stolen information would be deleted or protected against misuse.

In its October 27 incident update, GMO said people believed to be the attackers had published material they claimed related to the company and its customers. GMO was still checking the material and cautioned that some of it could be inaccurate. The company said it would contact affected customers individually if their information was confirmed in the publication.

GMO said the domain hosting the material had been taken down by approximately 4 a.m. on October 28. The company had not confirmed a ransomware attack, and its analysis of customer devices was continuing.

Customer payments and investigation

GMO has pledged to compensate realized losses from unauthorized trading when its investigation confirms they resulted from the breach. It also plans to pay ¥5,000 to every current Onamae.com Desktop Cloud customer, separately from compensation for confirmed trading losses.

The company has not disclosed an aggregate loss figure or the number of valid compensation claims. On October 28, it announced a reward of up to $1 million for information that could help identify and apprehend those responsible, and said it received 113 submissions within six hours.

Read More News

More FinanceVelix news

Disclaimer

This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.