What GMO has confirmed
The first notice came on October 21. GMO said it confirmed on October 20 that malicious programs had been installed in some customers' server environments. It began shutting down customer servers in sequence from 04:00 on October 21. That first notice also said no leak of customers' personal information had been confirmed.
That position did not last. In the second report on October 22, GMO said customers had reported unauthorized operations on trading accounts tied to trading tools used on the service's servers. It added that credentials for trading tools such as MT4/MT5, and for trading accounts used on the servers, may have been viewed by a third party.
The fourth report on October 24 went further. Per a summary of that report, GMO said its investigation had confirmed a security problem in the service's system, unauthorized access to the service environment, and that customer information was taken outside the company. GMO has not said what the vulnerability was or how the attacker got in. Commentary on Japanese platform note.com notes that GMO has acknowledged security issues but has not disclosed specifically what they were.
The 26,739 figure
GMO lists 26,739 servers as potentially affected, across all plans. That is a ceiling on possible exposure. It is not a count of confirmed breaches or victims. As one aggregator put it, the figure describes the possible scope, not a confirmed count of infected systems.
GMO also said it does not store customers' payment information, including credit card data, on the service's servers. That is narrower than saying nothing else was exposed. Anything customers kept on their desktops, such as saved passwords, trading tool logins and files, falls within the potential exposure.
Why a hosted Windows desktop makes this worse
Customers treat a cloud Windows desktop as a place to leave things running. The service is described as a VPS-type service that remotely connects to a virtual Windows environment in the cloud, with continuous operation of FX automated trading tools as a main use. These machines tend to hold three things at once:
- Saved broker logins and long-lived trading sessions.
- Automated trading software that can place orders without a human watching.
- Browsers, email and other accounts, often reused from the user's own PC.
If the host is compromised, the attacker can inherit all of it. That explains why GMO warned that changing a password may not end an existing session. This is general industry reasoning, not a GMO finding. It is also why GMO told customers to change passwords and then log off (disconnect) their sessions.
GMO also reports that it asked major exchanges and securities companies to block access via the service, forcibly terminate active sessions, and monitor for unauthorized transactions. The fourth report says it has also shut down network connections of the affected systems. Separately, one report says OANDA Securities Japan temporarily delayed customer withdrawals on October 22 as a precaution. So the effects reached beyond GMO's own customers.
Extortion, and an unverified attacker narrative
GMO says it received a money demand from someone believed to be the attacker. The person warned they would publish information about GMO and its customers if the demand was not met. The Register puts the demand at $50 million. GMO says it will not pay, because it has handed evidence to the police cybercrime unit and warns that anything the attacker publishes may include false content. GMO's stated reason is that paying would not guarantee deletion or prevent misuse.
Treat the attacker's own claims with caution. Posts circulating on social media allege sloppy design, such as a shared administrator account and default settings that exposed users' PCs. One analyst write-up on note.com lists these as claims and states that whether the attacker's explanation is correct has not been confirmed. GMO has not verified them either.
What customers should do
GMO's October 26 notice (Sixth Report) asks customers to:
- Run a full antivirus scan, not a quick scan, on PCs and phones used to connect to the service.
- Back up important files to external storage while it is disconnected from the network.
- From a different, secure device and via official websites rather than emailed or texted links, log out of all sessions through the broker's account page or support desk.
- Change passwords for FX, securities, email, Google and other accounts, and enable multi-factor authentication.
- Delete linked apps, forwarding rules, extensions and registered devices you don't recognize.
- Keep browser sync off until those checks are done.
GMO also warns that it will never ask for a password or authentication code, so treat any message asking for one as a scam. Be wary too of anyone offering to recover lost funds for a fee. The company is also asking some affected customers to lend it the PC they used to connect, so it can investigate. It says it will examine only records related to the incident and provide a confirmation document on data handling before borrowing anything. This is optional.
The Windows-relevant lesson here is the one from any remote desktop compromise. Anything you saved or logged into on the host should be treated as exposed.
Compensation
Under the fourth report, GMO will pay a flat ¥5,000 condolence payment to every customer currently using the service, whether or not they lost money. Registered customers are to be told how to claim by 23:59 JST on October 30, 2026.
Separately, GMO says it will compensate realized losses, including trading losses and fees, from transactions its investigation confirms were unauthorized and caused by the breach. It excludes market-fluctuation losses, profits that might have been earned, and other indirect damages. Claimants may be asked for transaction records and identity documents. They may also have to supply a view-only password for their trading platform so GMO can check the history. They should also ask their broker about cancellation or a refund. GMO will deduct any broker refund from its payment. It says it will publish the application procedure, documents, application period and payment schedule by November 6.
The platform itself looks unlikely to return in its current form. Rescana's summary of GMO's disclosures says GMO will not restart the current platform and will offer customers a replacement service instead. The Register reports that CEO Masatoshi Kumagai committed to a free alternative environment for six months, an overhaul of system infrastructure, and an outside-expert investigation.
The CEO's admission
The Register quotes Kumagai's blog post saying GMO's in-house white-hat hackers had previously flagged areas for improvement. He said the team was working on countermeasures but that, while weighing service availability and other priorities, the response lacked sufficient depth and speed. That is an unusually direct admission, and it will matter for regulators and claims. It is also the kind of trade-off most IT teams will recognize: known issues sit in the backlog while uptime pressures win.
Kumagai also argued that cheap AI tooling has lowered the skill needed for cyberattacks. He said GMO's security operation traced attacks on about 20 Japanese companies to misuse of an AI penetration-testing tool called ARTEX. As reported, that claim concerns a wider set of attacks. GMO's incident notices do not say ARTEX was used against Onamae.com Desktop Cloud, so don't read it as the cause here. GMO has also asked the Japanese government to apply "active cyber defense", which it describes as government-led identification and neutralization of attackers' infrastructure.
Takeaways for IT admins
- Hosted desktops concentrate credentials. Keep trading, banking and admin logins off shared or hosted machines where you can.
- Password changes alone don't end live sessions. Revoke sessions at the provider.
- Don't trust "no leak confirmed" in an early notice. GMO's own statements changed within days.
- Known findings that stay in the backlog are a governance risk, not just a technical one.
GMO's incident pages are the place to watch for the November 6 claim procedure and any technical post-mortem.