GMO Internet investigates Onamae cloud desktop data leak
GMO investigates suspected Onamae Desktop Cloud breach
Japanese internet and IT services company GMO Internet is investigating a suspected unauthorized access incident involving its Onamae Desktop Cloud service, a virtual desktop offering used by financial traders. The company said up to 27,000 servers may be affected and that a suspected attacker published information apparently linked to GMO and its customers.
GMO said it is still verifying the content of the published material, so the scope of the incident and the authenticity of the alleged data remain unclear. It has advised customers to reset their passwords after receiving reports of unauthorized operations on customer trading accounts.
Service shutdown and response timeline
On October 21, GMO shut down Onamae Desktop Cloud after identifying unauthorized access to its systems. The company also said it received an email from hackers demanding about 8 billion yen, roughly $50 million. It reported the incident to Japanese police the following day.
On October 24, GMO said it would provide compensation and an alternative service to customers while seeking assistance from government agencies. Between October 25 and 26, it began collecting customer devices to check for malware and to determine the extent of the damage.
On October 27, GMO stated that a suspected attacker had posted information that appeared to concern the company and its customers. The company did not confirm that the information was genuine, maintaining that its verification work was ongoing.
Broader security context
The incident followed a separate report by GMO Internet's cybersecurity unit that it had found evidence of a Chinese AI-enabled penetration-testing tool, Artex, being used in attacks against companies in Japan. GMO has not publicly established a connection between Artex and the Onamae Desktop Cloud incident.
CrowdStrike reported that Artex was also used in attacks against financial institutions in South Korea in September. Those attacks largely exploited weak security controls, including the absence of multi-factor authentication. Reuters reported that the tool's Chinese developer stopped public updates and made it closed-source after it was linked to cyberattacks targeting banks.
Japan's Financial Services Agency issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities. The regulator called for vulnerability management, defense-in-depth and incident preparedness, while encouraging the use of AI and other security tools. For businesses using hosted desktop environments, the immediate implication is to pair password resets with multi-factor authentication, endpoint investigation and tested incident-response procedures.