Hackers Post Data Linked to Japanese Internet Firm GMO

GMO Internet said on October 27, 2026 that it believes an attacker has published information linked to its customers and its business. The attacker got in through its Onamae cloud desktop service. TechCrunch reported the company's statement. GMO said it is still checking whether the published material is accurate, and it has not yet said how large the incident is.

A cloud desktop is a computer you use over the internet. The computer itself sits in a company's data center, and you see its screen on your own device. Onamae's service provided these virtual desktops to financial traders. GMO said up to 27,000 servers may be affected. The company told customers to reset their passwords after reports of unauthorized activity on customer trading accounts.

GMO's public notices show the incident unfolded over several days. On October 21, the company shut down its Onamae Desktop Cloud service after finding unauthorized access to its systems. On October 22, it reported the incident to Japanese police. On October 23, its parent company, GMO Internet Group, published a notice about unauthorized access to a service run by a subsidiary.

On October 24, the group announced plans to pay condolence money to customers, and compensation for losses from fraudulent transactions at GMO Internet Inc. These payments have been announced as plans. On October 26, Euronews reported that GMO would issue a goodwill payment of ¥5,000 to affected users.

While this was happening, the attackers were also demanding money. GMO said it received an email from hackers asking for about 8 billion yen, or roughly $50 million. Reuters reported that the company also received a threat to release company and customer information.

According to NHK, a hacker group released what it says is GMO customer personal information after the company ignored a deadline to pay. The Japan Times reported that the attackers vowed to keep leaking information on account holders, one at a time, until GMO agrees to pay. Nikkei Asia reported that the apparent culprit threatened ransomware attacks on user computers. Ransomware is malicious software that locks files or computers until a ransom is paid.

Some key details have not been made public. The way the attacker got in has not been described. The number of accounts that were accessed has not been given either. That is a separate figure from the server count.

In my view, the structure of this incident matters more than its headline numbers. A hosted desktop keeps a customer's work, logins and open sessions on servers the provider runs. When that layer is breached, the damage can spread well beyond one app, and the customer's own computer can become part of the problem. The password reset advice reflects that. It also means some of the immediate risk falls on users who had no role in the breach.

The broader context here is the tactic. Releasing data in batches, with a stated schedule for more, puts pressure on a company that is still working out how much it has lost. For a provider serving traders, each new release can mean another round of account checks. Whether the verification process narrows or widens the scope will decide how much of the 27,000-server figure relates to customer data.