GMO Internet shares fall up to 11% after cyberattack

GMO Internet shares had fallen as much as 11% by October 26, 2026, amid concerns about a cyberattack on its Onamae.com Desktop Cloud service. The company confirmed unauthorized access and the theft of customer information, and announced payments to customers after suspected attackers demanded money.

Key Takeaways

• The affected product is a desktop cloud service, not an FX brokerage.
• All current service customers will receive ¥5,000, separately from compensation for qualifying unauthorized-trading losses.
• GMO will replace the compromised infrastructure rather than restart it unchanged.

Table of Contents

• GMO Internet shares fall as breach concerns deepen
• Customer payments have two separate purposes
• Containment measures and government requests
• Conclusion

GMO Internet shares fall as breach concerns deepen

The decline of up to 11% was not identified as a closing return. It accompanied an incident that has disrupted a cloud service and raised concerns about customers’ connected trading accounts.

In its October 24 cyberattack response announcement, GMO Internet said its investigation had confirmed a security problem in the service’s systems, unauthorized access and the removal of customer information. Some customers had also reported trades they did not recognize.

The distinction between the cloud environment and a brokerage matters: GMO’s disclosure concerns the desktop service and unauthorized activity reported in customers’ trading accounts, rather than a confirmed breach of an FX brokerage’s own systems.

Customer payments have two separate purposes

GMO plans to pay every current customer of the affected service a uniform ¥5,000 goodwill payment, whether or not the customer suffered financial damage. That payment is separate from its compensation program for unauthorized trading.

Trading-loss compensation will cover realized losses, including trading losses and fees, where GMO’s investigation determines that unauthorized transactions resulted from this breach. Market-driven losses, profits customers might otherwise have earned and other indirect damages are excluded.

Eligibility will be assessed using trading records, access logs and other evidence. Refunds received from trading venues will be deducted from GMO’s payment, preventing compensation twice for the same loss.

Customers who want to continue using a Windows desktop environment will be offered an alternative service on independent cloud infrastructure, free for six months. GMO said migration would require customer consent and that terms would be disclosed before enrollment.

Containment measures and government requests

GMO said suspected attackers had demanded money and threatened further unauthorized trading, information disclosure and ransomware attacks. Those threats are not confirmation that every threatened action has occurred. The company said it would not meet the demands.

The company has disconnected affected systems from networks and requested that major trading venues and securities firms block access through the service, terminate active sessions and strengthen monitoring for unauthorized trades.

GMO also said it had provided evidence to police and sought government action, including active cyber defense measures aimed at identifying and disrupting attackers’ infrastructure. The request does not establish that the government has implemented those measures.

Conclusion

The next confirmed milestones are customer instructions on goodwill payments and replacement-service arrangements by October 30, followed by details of the trading-loss claims process by November 6. Those are notification deadlines, not promised payment dates.

Read More News

More FinanceVelix news

Disclaimer

This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.