GMO's Onamae.com Desktop Cloud hacked, data leaked

Hackers broke into Onamae.com Desktop Cloud, a VPS for FX trading

Onamae.com Desktop Cloud is a VPS that GMO Internet offers for automated FX trading. A VPS is a virtual server rented over the internet that keeps running all day, and customers used it to run MetaTrader 4 and 5 (MT4/MT5), the trading programs that place orders on their own.

From discovery to the leak (from GMO's notices)

Date	What happened
October 19	A customer inquiry prompts GMO to look into the service
October 20	Malicious programs found on some customer servers; new sign-ups and the control panel stopped
October 21	All plans shut down in turn from 4 a.m.; first public notice
October 22	GMO goes to the police
October 24	GMO confirms customer data was taken and announces payments
October 27	GMO confirms the attacker published data

GMO found malicious programs on October 20 and shut down all plans

A third party had placed malicious programs on some customer servers, GMO found on October 20. It stopped new sign-ups and the control panel that day, then began shutting down servers on every plan at 4 a.m. Japan time on October 21.

GMO puts the number of servers that may have been affected at 26,739. That figure counts servers in scope, not servers where an intrusion was confirmed.

GMO has no date for bringing the service back. It decided not to restart the current system at all.

Trading account logins saved on the servers were taken

In its 4th report on October 24, GMO confirmed that customer data had been carried off the servers. The data includes trading account login details that customers had saved in their trading tools, and some customers have reported trades on their accounts that they did not make.

As of the 16th report on October 29, GMO still had not said which data items were taken, how many records, or how the attacker got in. Credit card and other payment data are not on these servers, GMO says, but anything customers saved on their own server is in scope.

The attacker leaked data after GMO refused to pay

GMO received a threatening email on October 21 demanding about 8 billion yen, and it refused. Paying would not guarantee that the stolen data gets deleted or stays out of criminal hands, GMO said in its 8th report.

The attacker then warned that it would publish customer data and launch a ransomware attack at noon on October 27. That morning GMO asked customers to cut their PCs off the network, shut them down and pull the power cords. On the afternoon of October 27, GMO confirmed that data had been published.

Do not open or share the leaked files

GMO is asking everyone not to view, repost or share what the attacker published. The leak site collected information from the people who visited it, GMO found, and it advises anyone who already opened it to run a full virus scan.

On October 28 GMO also posted guidance on getting the attacker's site taken down. It says it is preparing legal action against people who spread the data maliciously.

A bounty of up to $1 million for tips on the attacker

GMO Internet Group is offering up to US$1 million for information that helps identify the attacker or explain the attack. The tip site opened at noon on October 28 and had received 321 tips by 6 p.m. on October 29. On the 29th, GMO's own security team handed the police information that may point to the culprit.

The bounty is for tips only. Do not hack into anything or contact the attacker on your own.

GMO will pay every customer and cover trading losses

Every current Desktop Cloud customer gets a flat 5,000 yen from GMO, whether or not they lost money. By 11:59 p.m. Japan time on Friday, October 30, GMO will email each customer's registered address with how and when the payment will be made.

Losses from unauthorized trades will be compensated

GMO will cover realized losses on trades it accepts were caused by the unauthorized access. Price differences and fees count; losses from normal market moves and indirect damage do not, and any refund a broker already paid is subtracted.

GMO plans to announce how to apply and which documents to send by Friday, November 6, on its website and by email. Which trades qualify is GMO's call, based on whether the unauthorized access caused them. (Update, November 13, 2026: at its earnings briefing, GMO Internet said compensation claims for unauthorized trades had reached about 2.998 billion yen. This is the amount claimed and will be finalized after review. Applications for the 5,000-yen goodwill payment stood at about 54 million yen as of November 12, and GMO expects an earnings impact of about 3.05 billion yen. Source: Nikkei xTech.)

Extra payments for customers whose data was published

Customers whose data the attacker published get an extra payment on top of the 5,000 yen and any loss compensation. The amount depends on what kind of data went public.

Extra payments by type of published data (from GMO's 12th report)

Type of data published	Payment
Basic details such as name and contact information	10,000 yen
Financial and login details such as trading account IDs and passwords	15,000 yen
Highly private information	25,000 yen

If several types were published, the amounts are added together, up to 3 million yen per publication. GMO is also moving customers to a replacement service on separate cloud infrastructure, free for six months after the move, and will not move anyone without their consent.

What Desktop Cloud users should do now

If you used Desktop Cloud, change your trading passwords and scan your own computers first. Both steps come straight from GMO's requests to customers.

Change trading passwords from a device you don't trade on

Change the passwords for your trading accounts and trading tools from a phone or PC you have not used for FX trading. Then log out every active session, check your trade history and balance, and report anything you don't recognize to your broker.

If your broker offers two-factor authentication, turn it on now. Also change:

• IDs and passwords you saved on the Desktop Cloud server
• Any other service where you used the same password
• Passwords saved in your browser

Scan your own PCs and ignore fake GMO messages

Run a full virus scan on every PC and phone you used to connect to the server. Back up your data and keep those backups somewhere safe.

GMO never asks for passwords or verification codes by email or phone, and it warns against anyone offering to recover lost money for a fee. Its help desk is open 24 hours a day by phone at 03-5456-2560 (from Japan) and through a web form.

What Onamae.com domain owners should check

If you register domains at Onamae.com, now is a good time to lock down your Onamae.com Navi login. Desktop Cloud and the domain service carry the same Onamae.com brand but are separate services.

GMO has not said whether domains are affected

None of GMO's 16 reports mention Onamae.com domains, rental servers or Onamae ID. They neither confirm nor rule out any effect. From the 1st report on, GMO has warned about phishing emails, texts and calls that use the incident as cover.

Onamae.com had already warned in August 2026 about phishing emails posing as the company to steal logins. Some carried subjects like 自動更新失敗 / Auto-Renewal Failed to pressure recipients into renewing, and some spoofed Onamae.com's own sender address. Skip the link in the email and sign in to Navi from your own bookmark to check a domain's status.

Turn on two-step verification and Domain Protection

Two settings protect a domain at Onamae.com: two-step verification in Navi and the Domain Protection option. Two-step verification asks for a one-time code sent by email or SMS when you sign in or make an important change. It is set up under ログインセキュリティ (login security) on your account page.

Domain Protection is a paid option at 1,078 yen per domain per year, tax included. With it, Whois changes, name server changes and transfers cannot go through without the registrant's approval. Taking over a domain by rewriting its registration data is called domain name hijacking, and JPRS, which runs the .jp registry, recommends two-step verification and regular checks of registration data.

Workplaces should check credentials kept on outside servers

Keeping IDs and passwords on outside servers and cloud services is common at work too. After a string of breaches, Japan's Information-technology Promotion Agency (IPA) urged organizations on October 9 to check their defenses. Another GMO group company reported its own case in October: infoQ data breach exposes up to 948,498 records.

Companies should list every cloud service and account they use

The first job for a company is to list every outside service it uses. IPA asks organizations to cover cloud services, VPNs and anything individual departments signed up for.

Then look for accounts nobody remembers creating and accounts that were turned off but are active again, and turn on multi-factor authentication. Keep only the data you need.

Staff should not reuse passwords and should turn on MFA

What each employee can do is avoid reusing passwords and turn on multi-factor authentication (MFA). With both in place, one leaked password does not open the next account. IPA's October 26 guide for individuals says the same, and also points to passkeys where a service supports them.

The same rule holds for work accounts: don't type a login into a page you reached from an email link. If coming up with a strong new password is a chore, the SOKUFU Password Generator makes a random one from the length and character types you pick.

In this case, logins that customers stored on their servers went to the attacker the moment the servers were breached. Storing logins in fewer places, and pairing the ones you must store with MFA, keeps one break-in from reaching your trading or bank accounts.