GMO Internet confirmed on October 27, 2026, that suspected attackers published information they claim belongs to the company and customers of its Onamae.com Desktop Cloud service.
The disclosure is a material escalation of the previously reported intrusion, which exposed credentials associated with hosted foreign-exchange trading environments and led to unauthorized transactions. The attackers had threatened to publish stolen information and deploy ransomware unless GMO paid approximately 8 billion yen, equivalent to about $50 million.
GMO has refused the demand and is coordinating its investigation with police and other authorities.
WHAT GMO HAS VERIFIED
GMO said it detected the publication at approximately 12:30 p.m. Japan Standard Time on October 27. The company is examining the material and has not yet verified that every file or claim made by the attackers is authentic.
The company confirmed that the publication occurred after an extortion deadline announced by the suspected attackers. GMO had warned customers before the deadline to back up important data, disconnect computers from networks, shut them down and unplug attached cables.
As of 1:55 p.m. on October 27, GMO had not detected the threatened ransomware deployment. That finding does not establish that customer computers are clean or that the threat has ended.
GMO’s investigators and white-hat security team continue to examine customer devices for malicious software and persistence mechanisms. Trend Micro and other security and artificial-intelligence companies have offered assistance.
PUBLISHED SITE CREATES AN ADDITIONAL SECURITY RISK
GMO issued an unusually strong warning against visiting the website hosting the purportedly stolen information. According to the company, the attackers can obtain information about people who access the site.
This means the publication infrastructure may serve two purposes: pressuring GMO through data exposure and collecting information about investigators, customers, journalists or other visitors.
Organizations should block access to the known publication domains through DNS filtering, secure web gateways and endpoint controls. Security teams should not retrieve suspected files outside a controlled forensic environment.
GMO also asked the public not to copy, redistribute or link to the information because doing so could increase identity theft, fraud, harassment and other secondary harm.
WHAT REMAINS UNCONFIRMED
GMO has not established publicly how much authentic customer information is contained in the published material. The company warned that some content may be inaccurate or manipulated.
The identity of the attackers also remains unconfirmed. Claims circulating under the name of a ransomware or extortion group should not be treated as verified attribution without supporting evidence.
No ransomware execution had been confirmed when GMO released its October 27 update. However, the investigation into customer devices remains active, and the company has not declared the environment safe.
FINANCIAL AND CUSTOMER IMPACT
The underlying compromise affected a hosted Windows desktop service frequently used for automated foreign-exchange trading. Earlier GMO disclosures said credentials stored in compromised server environments may have been obtained and misused for unauthorized transactions.
GMO previously estimated that as many as 26,739 servers and customer accounts across more than 70 securities and foreign-exchange businesses could have been exposed. It has promised to compensate customers for confirmed unauthorized trading losses and provide a 5,000-yen goodwill payment to current customers.
The company is separately considering additional compensation for people whose information is verified in the newly published material.
DEFENDER ACTIONS FOR HOSTED DESKTOP ENVIRONMENTS
Organizations using Onamae.com Desktop Cloud should keep affected systems isolated until GMO or a qualified incident-response team provides clearance.
Passwords for trading accounts, email, identity providers, remote desktops and administrative services should be changed from a known-clean device. Existing sessions, API keys, access tokens and remembered-device approvals should be revoked rather than relying on password changes alone.
Financial organizations should increase monitoring for unusual trades, new withdrawal destinations, account-recovery requests and login attempts from unfamiliar devices or locations. High-risk accounts may warrant temporary transaction restrictions.
Security teams should preserve endpoint, authentication, network and trading records beginning before the intrusion was discovered. Investigators should search for malicious programs, scheduled tasks, startup entries, remote-access tools and attempts to disable security software.
Employees and customers should expect targeted phishing calls, emails and messages that reference the breach or offer to recover losses. GMO says it will not request passwords or authentication codes and warns customers not to pay anyone claiming they can recover stolen funds.