Japan internet giant GMO says hackers posted stolen customer data

Company investigates breach of Onamae cloud desktop service; 27,000 servers potentially affected

By LineZotpaper AI staff

Published27 October 2026

Read Time2 min

Japanese internet giant GMO Internet is investigating a data breach after suspected unauthorized access to its Onamae cloud desktop service, with the company reporting on Monday that an attacker has posted information allegedly linked to customers and its business.

GMO Internet said on its blog that the content of the leaked information is still being verified and the full extent of the incident remains unclear. The company has advised customers to reset their passwords after receiving reports of “unauthorized operations” on trading accounts.

The incident began on October 21, when GMO shut down the Onamae Desktop Cloud service after discovering unauthorized access, and received a ransom demand of about 8 billion yen (~$50 million). The company reported the breach to Japanese police the following day. On October 24, GMO said it would offer compensation and alternative services while seeking government help. Over the following days, it began collecting customer devices to detect malware and assess damage.

The company said 27,000 servers may be affected by the breach. GMO did not immediately respond to a request for comment.

Separately, about a week before the breach, GMO’s cybersecurity unit reported evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in attacks targeting companies across Japan. Artex was also used to hack South Korean financial institutions in September, according to a CrowdStrike report. GMO said it has not publicly established a connection between Artex and the Onamae breach.

Japan’s Financial Service Agency issued guidance in May urging financial institutions to strengthen basic defenses, including vulnerability management and incident preparedness, amid rising cybersecurity risks.

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Analysis

Why This Matters

Customers of GMO’s Onamae service face potential financial losses from unauthorized trading activity and exposure of personal data.
The breach highlights ongoing vulnerabilities in cloud-based financial infrastructure, even at major internet companies.
Japan’s financial regulator has already warned about rising cyber risks, underscoring the need for stronger basic security controls across the industry.

Background

GMO Internet is a major Japanese IT and internet services provider, offering web hosting, domain registration, and cloud services. Its Onamae brand provides virtualized desktop environments, particularly to financial traders. The breach follows a separate discovery that a Chinese AI-powered penetration testing tool, Artex, has been used in attacks on Japanese firms, though no link to the Onamae incident has been confirmed.

What to Watch

Whether the posted data is confirmed as genuine and what customer information it contains.
Further regulatory action from Japan’s Financial Service Agency if the breach is linked to inadequate security measures.
Whether the Artex tool is found to be involved, which could signal a broader campaign against Japanese financial institutions.

Sources

Japan internet giant GMO says hackers posted stolen customer data · TechCrunch

Checked

12 claims in this story checked against 1 source: 5 supported.

Show each claim

Partly supportedHackers posted stolen customer data.TechCrunch: “Oct 27 : The Japanese IT firm said a suspected attacker had posted information that appeared to be linked to the company and its customers. GMO said it was still checking whether the information was genuine.”
Partly supportedGMO reported that an attacker had posted information allegedly linked to customers and its business.TechCrunch: “The IT and internet services giant said on its blog that it believes the attacker has published information allegedly linked to customers and its business.”
Not in the sourcesGMO reported the posting on Monday.TechCrunch: “Oct 27 : The Japanese IT firm said a suspected attacker had posted information that appeared to be linked to the company and its customers.”
SupportedThe company said 27,000 servers may be affected by the breach.TechCrunch: “The company said 27,000 servers may be affected by the breach.”
SupportedThe contents of the leaked information are still being verified, and the full extent remains unclear.TechCrunch: “However, the contents are still being verified and the full extent of the incident remains unclear.”
SupportedCustomers reported “unauthorized operations” on trading accounts.TechCrunch: “GMO Internet has since advised customers to reset their passwords, amid receiving reports of “unauthorized operations” performed on customer trading accounts.”
Partly supportedGMO advised customers to reset passwords after receiving reports of unauthorized operations.TechCrunch: “GMO Internet has since advised customers to reset their passwords, amid receiving reports of “unauthorized operations” performed on customer trading accounts.”
Partly supportedThe incident began on October 21, when GMO shut down the service after discovering unauthorized access.TechCrunch: “Oct 21: GMO Internet shut down its Onamae Desktop Cloud service after discovering unauthorized access had occurred to its systems without permission.”
SupportedGMO received a ransom demand of about 8 billion yen (about $50 million).TechCrunch: “The IT firm also received an email from hackers demanding about 8 billion yen (~$50 million).”
SupportedGMO reported the incident to Japanese police the following day.TechCrunch: “Oct 21: GMO Internet shut down its Onamae Desktop Cloud service after discovering unauthorized access had occurred to its systems without permission. The IT firm also received an email from hackers demanding about 8 billion yen (~$50 million). Oct 22 : The Japanese company reported the incident to Japanese police and shared another public update .”
Partly supportedGMO did not immediately respond to a request for comment.TechCrunch: “A spokesperson for GMO Internet did not respond to TechCrunch’s request for comment.”
Partly supportedThe FSA issued guidance in May amid rising cybersecurity risks, urging stronger basic defenses including vulnerability management and incident preparedness.TechCrunch: “A spokesperson at Japan’s Financial Service Agency (FSA) told TechCrunch that it issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities. The regulator called for stronger basic defenses, including “vulnerability management, defense-in-depth and incident preparedness,””