GMO Onamae breach: customer data confirmed taken from Desktop Cloud, saved trading logins misused
GMO Internet confirmed on October 24, 2026 that customer information was taken from its Onamae.com Desktop Cloud service in Japan, after attackers planted malware on customer servers and misused trading-account logins saved in trading tools; up to 26,739 servers are in scope, and payment data was not stored on the servers.
What happened
GMO Internet, part of Japan’s GMO Internet Group, confirmed on October 20, 2026 that an unauthorised third party had planted malicious programs in some customer environments of Onamae.com Desktop Cloud, a Windows virtual-server service that traders use to run MetaTrader 4 and MetaTrader 5 automated trading around the clock. GMO progressively shut down every server on every plan from 04:00 on October 21, and there is no restart date. Up to 26,739 servers may be affected — that figure is the maximum scope of the investigation, not a confirmed count of infected servers.
On October 24, in its fourth public report on the incident, GMO said its investigation had confirmed a security problem in the service’s own system, unauthorised access to the service environment, and that customer information was taken out. GMO said a person believed to be the attacker had demanded money and threatened to keep placing unauthorised orders in customers’ accounts at more than 70 securities and foreign-exchange firms in Japan and abroad, to publish customer information, and to launch ransomware attacks. GMO said it will not pay, has given its evidence to the police, will pay ¥5,000 to every current user and compensate realised trading losses it finds were caused by the attack, and will not restart the compromised platform — customers who want a Windows desktop can move to an alternative service on a separate platform, free for six months. On October 27 the attackers began publishing what they claim is GMO and customer data; GMO confirmed the publication, warned that the leak site collects visitors’ information and may contain false content, and said no ransomware activation had been confirmed and no malware had been found on the customer PCs it had analysed so far.
Who is affected
Customers of Onamae.com Desktop Cloud in Japan — current users of the service, with up to 26,739 servers in scope. What was taken is information stored on the servers, including trading-account login information saved in trading tools: GMO said on October 22 that login details for trading accounts saved on the servers may have been taken and misused, and customers have reported unauthorised operations in their trading accounts. Brokers have confirmed the misuse independently of GMO: OANDA Japan reported unauthorised logins linked to the service, and FXTF said it had found several MetaTrader accounts where trades were made against the customer’s will and had restricted them. GMO has not published a full list of the customer information taken out. Payment information such as credit card details was not stored on the servers — it is held on separate infrastructure and is not affected.
How serious
The concrete risk is direct financial loss, and it has already happened: a saved trading login lets an attacker place real orders in a customer’s brokerage account, and GMO is compensating realised losses precisely because unauthorised trades were made. Changing a password alone may not end the access — GMO warned on October 23 that at some brokers an existing session can stay open for a while after a password change, so an attacker can keep trading until every session is cut. The data taken out can also be reused: information about a customer’s trading service, accounts and connected PC can support targeted phishing that cites real details, and material the attackers began publishing on October 27 may be copied and recirculated even though GMO warns some of it may be false. Card fraud from GMO’s own payment records is not the risk here, because payment data was not on the servers.
What to do now
If you used Onamae.com Desktop Cloud, follow GMO’s advice now. Change the passwords of your trading tools and brokerage accounts urgently, from a device you do not use for trading, and then disconnect every existing session through your broker — a password change by itself may leave a live session open. Turn on two-step verification where your broker offers it. Check your trade history and balances and contact your broker about anything you do not recognise. Change any other credentials that were stored on the server, and anywhere the same password was reused. Back up your data offline, and follow GMO’s October 27 request to customers who connected to the service: scan your own PC, disconnect it from the network and shut it down as directed. Do not open or reply to messages from anyone claiming to be the attacker, and do not visit or download from sites offering the leaked data — GMO warns the leak site itself collects visitors’ information. GMO says it will never ask for your password or card details by email or phone. On compensation, GMO said the ¥5,000 payment goes to all current customers whether or not they lost money, and that the process for claiming realised trading losses would be set out by November 6.
Sources: BleepingComputer, reporting GMO’s October 20–21 announcement · Japan Cyber Watch, tracking GMO’s public reports through October 27 · TechCrunch, October 27