Key Notes
- GMO says 26,739 cloud servers are potentially affected, while the number of confirmed compromises remains under investigation.
- Verified unauthorized trading losses and fees qualify for compensation separately from a ¥5,000 goodwill payment to current customers.
- CEO Masatoshi Kumagai acknowledges that internal security warnings were addressed too slowly, while the total financial impact remains unknown.
GMO Internet Group Inc. (TSE: 9449) faces compensation costs after hackers breached a cloud service used by foreign-exchange traders, exposing account credentials and triggering reports of unauthorized trades that erased customers’ balances within seconds.
The affected service, Onamae.com Desktop Cloud, is operated by listed subsidiary GMO Internet Inc. (TSE: 4784). The company has confirmed customer information was taken outside its systems and promised to cover verified losses from unauthorized transactions.
On October 25, group founder and CEO Masatoshi Kumagai acknowledged that internal security specialists had identified weaknesses before the intrusion, but the response lacked sufficient speed and depth. The admission adds a management failure to an incident already affecting customers’ access to their trading infrastructure.
Traders Report Balances Destroyed Within Seconds
TBS NEWS DIG reported that a 44-year-old customer lost about ¥4.16 million in roughly two seconds through trades he said he had not authorized. The broadcaster examined his transaction history, which showed losses and fees.
In a separate interview, Nippon TV reported that a Tokyo customer in his 30s lost about ¥3 million in four seconds. These are individual accounts documented by broadcasters, rather than a company-verified total for the incident.
The reported damage came through trading activity, rather than a conventional withdrawal to an attacker’s bank account. That distinction matters: access to a brokerage account can expose its balance to losses even when an intruder cannot directly transfer the money out.
Desktop Cloud provides remote server environments used to keep trading applications running. Customers can operate tools such as MetaTrader 4 and MetaTrader 5 there, potentially placing account credentials and trading access inside the same hosted environment.
Nearly 27,000 Servers Are Potentially in Scope
GMO’s third notice identified 26,739 potentially affected servers across all Desktop Cloud plans. It explicitly said this was not the number of confirmed intrusions or cases of information theft.
The investigation began after a customer inquiry on October 19. GMO confirmed unauthorized software in some customers’ server environments the following day and began shutting down all plans at 4 a.m. Japan time on October 21.
The notices concern this particular cloud service. They do not establish that GMO’s entire internet business, its cryptocurrency exchange or the underlying systems of customers’ brokers were compromised.
GMO says it does not hold customer payment information, including credit-card details, on the service’s servers. Information customers themselves stored inside their environments remains within the potential exposure, including trading logins.
Compensation Goes Beyond the ¥5,000 Payment
GMO will pay every current service customer ¥5,000 as a goodwill gesture, separately from compensation for qualifying realized trading losses and fees. Ordinary market losses, lost potential profits and indirect damages are excluded.
Eligibility depends on GMO’s review of trading and access records. Broker refunds will be deducted to avoid double recovery; a broker’s refusal to refund does not itself disqualify an otherwise eligible claim.
Goodwill-payment details are due by October 30, with the claims process and payment timetable to follow by November 6. GMO has not quantified the earnings impact. The compromised infrastructure will not restart unchanged: customers will be offered an alternative on independent infrastructure, free for six months.
Extortion Threats Extend Beyond the Cloud Service
GMO says a person believed to be the attacker demanded money and threatened further unauthorized orders in customer accounts at more than 70 domestic and overseas securities and FX firms. That is a threat concerning accounts, not confirmation that 70 brokers were hacked.
The threats also cover customer and company data disclosures and ransomware attacks. GMO refuses to pay and has submitted evidence to police. It has asked financial firms to block connections from the affected service and terminate active sessions.
In its latest notice, GMO again urged customers to change credentials from a separate device and end existing trading sessions. It warned that changing a password alone may leave an already authenticated connection active, depending on the broker’s systems.
Security Warnings Put Management Under Scrutiny
Kumagai wrote that in-house white-hat hackers had previously raised issues with the service. Teams were working on remedies, but concerns about availability and competing priorities slowed an adequate response, leaving an opening for attackers.
He also warned that misuse of AI was accelerating cybercrime and called for stronger government cooperation. His broader warning does not establish that AI was used in this specific breach; the intrusion route and full extent of the compromise remain under investigation.
The episode highlights the gap between finding weaknesses and resolving them. As we previously reported, a separate security-remediation effort at Bank of America required about 1,000 additional contractors. For GMO, the immediate financial questions are the verified customer-loss total, compensation costs and the expense of rebuilding a service customers can trust.
