Overview
- GMO disclosed on Saturday that its Onamae.com Desktop Cloud servers for FX automated trading were infected with malicious code and that customer information was confirmed to have been exfiltrated.
- Multiple users reported rapid, unauthorized trades that wiped out cash balances in seconds to minutes and GMO said it will compensate losses it judges to be caused by the breach and pay every user a ¥5,000 consolation payment.
- The attackers demanded money and threatened to publish stolen data, manipulate customer accounts, and deploy ransomware; GMO publicly refused to pay, saying payment would not guarantee deletion or stop misuse.
- GMO has suspended the affected service, will provide a substitute service free for six months, has handed communication records to police, and has formally asked the government to authorize active cyber defense measures as the criminal probe continues.
- Company filings say up to 26,739 servers may have been affected and the case could become the first use of Japan’s active cyber defense rules enacted in 2025, making confirmation of total losses and the government’s decision on intervention the next key developments.