GMO Internet: Onamae Desktop Cloud breached, data posted online

Japan’s GMO Internet group is dealing with a serious incident on Onamae Desktop Cloud, the virtual desktop service of the Onamae.com brand, used mostly by foreign-exchange (forex) traders. After the unauthorized access, the attackers demanded a ransom of about 8 billion yen (around 50 million dollars) and, according to the company’s latest update, posted information that appears to relate to GMO and its customers. Whether the data is genuine is still being verified.

What happened

The three outlets that covered the case (TechCrunch, Infosecurity Magazine and DataBreaches.net) agree on the main sequence, based on the notices published by GMO:

• 20 October: according to Infosecurity Magazine, GMO discovers that “malicious programs” have been installed in some customers’ server environments;
• 21 October: the service is suspended and the extortion email arrives, demanding about 8 billion yen;
• 22 October: the incident is reported to the Japanese police;
• 24 October: GMO announces compensation and an alternative service for customers and asks government agencies for support;
• 25–26 October: the company starts collecting customers’ devices to look for malware and assess the damage;
• 27 October: according to TechCrunch, GMO says a suspected attacker has posted information that appears to be linked to the company and its customers.

The scope is wide: GMO puts the number of potentially affected servers at up to 26,739 (TechCrunch rounds it to 27,000). TechCrunch also reports that the company received reports of “unauthorized operations” on customers’ trading accounts and asked everyone to reset their passwords.

The ransomware threat and the advice to switch off PCs

The most unusual element is reported by Infosecurity Magazine and DataBreaches.net. According to Infosecurity Magazine, after GMO refused to pay, the attackers announced they would deploy ransomware at 12:00 on 27 October. GMO therefore asked customers to run a full antivirus scan, back up all their data, disconnect their PC from the internet and switch it off; DataBreaches.net quotes the literal advice to unplug every cable connected to the computer.

In the same notice, quoted by Infosecurity Magazine, GMO states that as of 11:59 on 27 October no malware, ransomware included, had been found on the devices analysed so far, but that the analysis is not complete and more devices are still to arrive. The sources do not explain how the attackers could have reached customers’ PCs from the virtual desktops.

What is still unknown

The sources do not name the initial access vector, any CVE, malware family or criminal group. There are therefore no public indicators of compromise to hunt for.

TechCrunch notes that about a week earlier GMO’s security unit had reported the use of Artex, a Chinese AI-enabled penetration testing tool, in attacks against Japanese companies; according to a CrowdStrike report, the same tool was used in September against South Korean financial institutions, mainly by exploiting weak controls such as the lack of multi-factor authentication. However, GMO has not publicly linked Artex to the Onamae breach: this is context, not attribution.

Why it matters for European companies

The case shows the risk of a hosted virtual desktop provider (DaaS/VDI): a single point of compromise gives access to thousands of environments belonging to different customers and, for traders, to sessions already connected to financial accounts and platforms. Many European and Italian companies use similar services for remote work, external consultants or business applications.

For NIS2 entities, supply chain security is one of the measures required by Article 21; for banks, brokers and other financial entities, the DORA regulation requires ICT third-party risk management and exit strategies for critical providers. An incident like this is exactly the scenario those plans should cover: a service suspended for days, data potentially exfiltrated, devices to be collected and analysed.

What to do now

If you use Onamae Desktop Cloud, or your staff do:

• follow GMO’s notices and change the passwords of the service and of every account accessed from the virtual desktops, trading accounts first;
• check recent transactions and logins on the linked accounts and report any unrecognised operation to your broker immediately;
• treat the PCs used to connect as potentially at risk until the analysis is complete: full scan, offline backup, no connection to the corporate network until they are verified.

For any third-party remote or virtual desktop service:

• make multi-factor authentication mandatory on all remote access and on the accounts reachable from the sessions;
• limit the channels between the hosted desktop and the local PC (clipboard, shared drives and printers) to what is strictly necessary;
• check the logs for remote logins outside working hours, from unusual countries or after bursts of failed attempts (MITRE ATT&CK techniques T1133 External Remote Services and T1078 Valid Accounts);
• check that contracts include incident notification times, audit rights and a tested exit procedure;
• keep offline backups of the data that goes through the service.

How ARXDOME helps

ARX Sentry shows remote desktop logins, night-time logins and bursts of attempts in its identity pages, so abnormal use of credentials surfaces quickly. ARX Expose flags company accounts that appear in data breaches, which helps if the published information turns out to include credentials. If a PC used to connect to the service looks suspicious, ARX Shield lets you isolate it from the network pending analysis.

Last updated: 28 October 2026