Japanese ISP GMO Internet warned customers that up to 26,739 servers on its Onamae.com Desktop Cloud service were compromised by an attacker demanding a $50 million ransom, prompting the company to advise affected users to change trading passwords immediately from separate devices.
GMO Internet Admits Security Vulnerabilities Exposed 26,739 Cloud Desktops
The breach hit a service widely recommended for foreign exchange trading. GMO Internet revealed that unauthorized parties installed malicious programs across server environments on the Onamae.com Desktop Cloud.
Customers quickly reported unauthorized operations on their trading accounts. Some users spotted transactions they did not recognize.
The company confirmed that customer information left its systems. It urged major trading services to forcibly terminate active sessions and block incoming trade requests from the compromised virtual desktop cloud.
GMO Refuses $50 Million Demand and Offers User Payments
The attacker demanded $50 million. They threatened to publish company and customer data if the ISP refused to pay.
GMO refused the payout. The company stated that complying offered no guarantee that stolen data would be deleted or kept out of misuse.
CEO Masatoshi Kumagai offered a ¥5,000 condolence payment to affected users. He described the amount in a blog post as a token of initial sincerity.
The company also promised to cover trading losses caused by the breach. GMO pledged to provide a free alternative environment for six months while overhauling its infrastructure.
In-House Warnings and Autonomous AI Exploit Claims
Internal white-hat hackers had previously flagged security gaps to the team. The company acknowledged that its response lacked sufficient depth and speed.
Kumagai pointed to broader industry shifts in cyber warfare. He argued that open-weight AI models allow bad actors to easily combine tools into advanced attack vectors.
According to the CEO, GMO Group operations confirmed that an attack targeting roughly 20 Japanese companies misused “ARTEX.” That software is an autonomous AI penetration testing tool originally built for defense.
The company submitted a formal proposal to the Japanese government advocating for proactive cyber defense. Kumagai argued that private entities cannot secure national cyberspace alone against modern automated threats.
Next Steps for Affected FX Traders
Trading apps may keep sessions active even after users change passwords. GMO advised traders to check account pages or contact support desks directly to disconnect all active sessions.
Investigations into the 26,739 VDI servers remain ongoing. External experts are assisting the company with system remediation and recurrence prevention.
