If you used GMO Internet’s Onamae.com Desktop Cloud, a remote Windows desktop service in Japan that many people used to keep forex trading software running around the clock, change your broker passwords today, from a different device. GMO says attackers installed malicious programs on customer servers, customer information was taken, some customers have reported trades they didn’t make, and on October 27 the suspected attackers published what they claim is stolen data.1, 3, 5
Reporting checked October 28, 2026.
Too long; didn’t read?
- Up to 26,739 customer servers may be affected. All Desktop Cloud plans have been shut down since October 21.1
- Passwords for trading tools and trading accounts saved on those servers may have been seen.2
- GMO will compensate confirmed losses from unauthorized trades and is paying every current user ¥5,000.3
- Do not open the claimed leak site: GMO says the attackers collect information about everyone who visits it.5
Why a cloud desktop matters to your money
A cloud desktop is a Windows computer that runs in a data centre and that you use over the internet. BleepingComputer reported that GMO advertised this service for keeping automated forex trading, including MetaTrader 4, running non-stop.4 That convenience has a catch: the broker logins saved in that trading software are effectively keys to your money, and they were sitting on a machine the attackers got into.
What GMO has confirmed
October 21: GMO said it had confirmed on October 20 that a third party installed malicious programs on some customer servers, with 26,739 servers potentially affected. It began shutting down all Desktop Cloud plans at 4:00 a.m. Japan time on October 21. At that point it had not confirmed any leak of personal information it holds, and it said it does not store card details.1
October 22: GMO warned that passwords for trading tools and trading accounts stored on the servers may have been viewed, and that customers had reported unauthorized trades.2
October 24: GMO said its investigation had confirmed security weaknesses in the service, that unauthorized parties got in, and that customer information was taken outside the company.3
October 27: GMO said that at 12:30 Japan time, people believed to be the attackers published material they describe as GMO and customer information. GMO is still checking it and warns that it may contain information that isn’t true. As of 13:55, it had not confirmed a ransomware attack, meaning malware that locks files and demands payment.5
Compensation
GMO says it will compensate realised losses, such as trading losses and fees, from trades its investigation confirms were unauthorized, with conditions; details of how to apply are due by November 6. Separately, every current user gets a ¥5,000 payment, with emails due by October 30.3 In its twelfth update on October 27, GMO added extra payments of ¥10,000 to ¥25,000 per category of information for customers whose data it confirms was published, and said it will contact those customers individually.6
Update, October 28
GMO says the attackers’ leak site went offline at around 4:00 a.m. Japan time on October 28, after it worked with other companies to have the domain suspended. It will try to take down any new copies and warns that people who maliciously repost the leaked information could face legal action.8
GMO also says it received an extortion email demanding about ¥8 billion on October 21, and that it will “never” give in to the attackers’ demands. Instead it has offered a reward of up to US$1 million in total for information about the attackers, and it received 113 tips in the first six hours.9, 10 Its analysis of customer computers handed in so far has found no signs of malware infection or ransomware on them; GMO still asks customers to run a security scan and make a backup before using them again.10
What you can do now
- Change your trading passwords from a different device, one you haven’t used for forex trading on the service, as GMO advises.7
- End all active logins at your broker. GMO warns that some broker connections can stay active after a password change; disconnect them or ask your broker to.7
- Check your trade history and balance, and contact your broker about anything you don’t recognise. Keep records of dates, times and amounts for a compensation claim.2, 3
- Turn on two-step verification at your broker if it is offered.2
- Change every other password that was saved on the server or in its browser, and anywhere you reused them.7
- Stay away from the claimed leak. Don’t visit or share it. If you already opened it, GMO says to run a full antivirus scan.5, 6
- Beware of “recovery” offers. GMO says it will never ask for your passwords or authentication codes, and warns against paying anyone who offers to get your money back.3, 6
Sources
- GMO Internet, October 21, 2026: Apology and notice regarding unauthorized access by a third party to Onamae.com Desktop Cloud
- GMO Internet, October 22, 2026: Notice and apology regarding unauthorized access to Onamae.com Desktop Cloud (second report)
- GMO Internet, October 24, 2026: Notice and apology regarding unauthorized access to Onamae.com Desktop Cloud (fourth report)
- BleepingComputer, October 21, 2026: Japan’s Onamae Desktop Cloud hacked, up to 27,000 servers affected
- Onamae.com (GMO Internet), October 27, 2026: Current response to unauthorized access to Onamae.com Desktop Cloud (tenth report, in Japanese)
- Onamae.com (GMO Internet), October 27, 2026: Current response to unauthorized access to Onamae.com Desktop Cloud (twelfth report, in Japanese)
- GMO Internet, October 23, 2026: Notice and apology regarding unauthorized access to Onamae.com Desktop Cloud (third report)
- GMO Internet, October 28, 2026: Current response to unauthorized access to Onamae.com Desktop Cloud (thirteenth report)
- GMO Internet Group, October 27, 2026: Response policy, special payments and cybercrime bounty (in Japanese)
- GMO Internet Group, October 28, 2026: Current response to unauthorized access (fourteenth report, in Japanese)
