GMO cloud breach hits FX traders' accounts at 70+ brokers

GMO Internet said on October 24, 2026 that attackers broke into Onamae.com Desktop Cloud, a server service that currency traders rent to run automated trading. The intruders saw login data stored on those servers, including investors' broker passwords. Trading accounts at more than 70 securities and FX firms may have been misused, the Yomiuri Shimbun reports.

The company will pay every user ¥5,000, about $32, whether or not they lost money. It also asked the Japanese government to use its new "active cyber defense" powers against the attackers.

What was breached

Onamae.com Desktop Cloud rents out virtual servers, remote computers that run around the clock. FX traders, who trade foreign currencies, use them to run trading programs that place orders automatically. Those programs need the trader's broker login, so the passwords sit on the server.

More than 20,000 people use the service, according to the Yomiuri. Jiji Press puts the number of servers that may be affected at 26,739. The two outlets count different things, users and servers, so the figures do not conflict.

According to the Yomiuri, third parties viewed the stored login data and then made unauthorized trades.

How it unfolded

Date (2026)	Event
October 20	An unauthorized third-party program is found on some servers
October 21, 4 a.m.	GMO halts the servers
October 22	GMO consults the Tokyo Metropolitan Police
October 23	GMO Internet Group files its first notice to investors
October 24	GMO confirms information was taken, announces payments and asks the government to act

The timeline comes from the Yomiuri and the Asahi Shimbun.

Losses and extortion

Customers have lost real money. The Asahi spoke to a 29-year-old woman in Aichi who lost about ¥4.3 million and a 32-year-old man in Saitama who lost about ¥550,000. A hacker group claims losses in the tens of billions of yen, the Yomiuri reports. That claim is unverified, and GMO has given no total.

Someone believed to be the attacker demanded money and threatened to publish company and customer data. GMO refused. "We will not comply with the attacker's demands," the company said, according to Jiji. Paying would not guarantee the data is deleted or stop it being misused, GMO explained, according to the Asahi.

On the afternoon of October 24, a suspected attacker posted online that it would hit customers' own PCs with ransomware. GMO told users to back up their data and run virus scans, the Asahi reports.

What GMO is offering

GMO will pay a flat ¥5,000 to every user of the service. It will also cover losses and fees from trades confirmed as unauthorized, but not indirect damages. Users will get application details by email by November 6. Anyone who wants it gets a replacement cloud service free for six months.

"We take seriously the fact that we were unable to protect customers' information and assets," GMO said, as quoted by the Asahi.

A first test for Japan's new cyber law

Japan's active cyber defense law took effect on October 1, 2026. It lets police and the Self-Defense Forces enter attackers' servers to shut down an attack, the Yomiuri explains. GMO urgently asked the government to apply it. Its statement said private companies acting alone struggle to stop the theft of citizens' assets, Briefs reports.

The government has not said whether it will act. A Yomiuri headline cites an unnamed government official saying the system is not activated on request.

The breach adds to a hard month for Japanese companies. Japan's government told firms and banks to tighten security on October 9 after more than 20 reported attacks.

What this means for developers

If you used Onamae.com Desktop Cloud, change every broker password stored on it now, from a clean device. Turn on two-factor login at each broker and check your trade history for orders you did not place.

Anyone running trading bots or other automation on a rented server should treat that server as a target. Where a broker offers API keys, use them instead of your main password. Limit each key to trading only, with no withdrawals, and lock it to known IP addresses.

Keep secrets out of plain files. A password manager or a secrets store with encryption at rest makes stolen disk contents far less useful.

Watch Tokyo's answer to GMO. Whether the government uses its new powers here will show how far Japan will go to defend private companies from attacks.