GMO Internet Says Hackers Have Published Data Linked to Onamae Customers
GMO Internet said on October 27, 2026 that it believes an attacker has published information allegedly linked to its customers and its business, following unauthorized access to its Onamae cloud desktop service. TechCrunch reported the company's statement. GMO said the contents of the published material are still being verified and that the full extent of the incident remains unclear.
The Onamae cloud desktop service provides virtualized desktops to financial traders. These are complete remote computers run by the provider in its own data centers, which users reach over the internet. GMO said up to 27,000 servers may be affected by the breach. The company advised customers to reset their passwords after reports of unauthorized operations on customer trading accounts.
GMO's public notices trace the incident over several days. On October 21, the company shut down its Onamae Desktop Cloud service after discovering unauthorized access to its systems. On October 22, it reported the incident to Japanese police. On October 23, its parent, GMO Internet Group, published a notice about unauthorized access to a service provided by a consolidated subsidiary. On October 24, the group published a notice about payment of condolence money to customers and compensation for losses from fraudulent transactions at GMO Internet Inc. The group has announced these payments as plans. On October 26, Euronews reported that GMO would issue a goodwill payment of ¥5,000 to users affected by the attack.
The extortion attempt has run in parallel. GMO said it received an email from hackers demanding about 8 billion yen, or roughly $50 million. Reuters reported that the company also received a threat to disclose company and customer information. According to NHK, a hacker group released information it says is GMO customer personal information after the company ignored a deadline to pay. The Japan Times reported that the attackers vowed to keep leaking information on account holders one at a time until GMO agrees to pay. Nikkei Asia reported that the apparent culprit threatened ransomware attacks on user computers, meaning attacks that lock files or threaten to expose them until a payment is made.
The attack vector has not been publicly described. Neither has the number of accounts that were accessed, which is a distinct figure from the server count.
In my view, the structure of this incident matters more than its headline figures. A hosted desktop places a customer's working environment, login credentials and active session state on infrastructure the provider operates. When that layer is compromised, the exposure is not confined to one application or one database, and the customer's own endpoint can become part of the problem. The password reset advice reflects that reality. It also shifts a share of the immediate risk onto users who had no direct role in the breach.
The broader context here is the tactic itself. Publishing data in tranches, with a stated schedule of further releases, adds pressure on a company that is still establishing the scope of its own losses. For a provider serving financial traders, each new disclosure can trigger a fresh round of account reviews. Whether the verification process narrows the scope or widens it will determine how much of the 27,000-server figure turns out to be relevant to customer data.
