GMO Onamae.com Desktop Cloud Compromise: FX Trading Servers Breached, Broker Accounts Traded, $50M Ransom Refused

Updated October 27, 2026, 2:45 AM CT. GMO Internet's Onamae.com Desktop Cloud, a Windows server rental service for automated FX trading, was breached. Brokers say trading logins leaked from those servers were used to place unauthorized orders; five brokers have reported customer losses. GMO refused a $50 million ransom, and GMO says the attacker began posting information after a noon deadline on October 27 Tokyo time.

Full analysis: 26,739 Servers. More Than 70 Brokers. GMO's Own Help Page Says File Sharing Came Pre-Set.

GMO says up to 26,739 servers may be in scope. On October 24 it confirmed that "a security problem existed in the Service's system" and that customer information "was taken outside the company." The attacker threatened to keep tampering with customers' accounts at more than 70 securities and FX firms in Japan and abroad.

Timeline (Tokyo time, with US Central)

• October 19. A customer inquiry starts GMO's investigation.
• October 20. GMO confirms unauthorized programs on some customer servers; suspends new sign-ups and the control panel.
• October 21, 4:00 AM (2:00 PM CT Oct 20). Report No. 1. Rolling shutdown of all servers begins. 26,739 servers possibly affected. "We have not confirmed any leak of the personal information entrusted to us."
• October 21, 11:57 AM (9:57 PM CT Oct 20). Extortion demand received: $50 million in cryptocurrency by 5:00 PM that day (amount disclosed Oct 26).
• October 21. Gaitame Finest restricts affected accounts. Customers report trades they did not place.
• October 22. GMO consults police. Report No. 2 warns that MetaTrader logins saved on servers may have been obtained. FSA asks FX firms, via the Financial Futures Association of Japan, to warn customers and monitor trading. OANDA Japan briefly holds withdrawals.
• October 23. Report No. 3: 26,739 is a scope figure, not confirmed intrusions; sessions may survive password changes depending on the broker.
• October 24, 11:50 AM (9:50 PM CT Oct 23). Report No. 4: exfiltration confirmed; extortion disclosed; ¥5,000 per customer; realized losses covered; service will not restart; request to government for active cyber defense.
• October 25. Chairman Masatoshi Kumagai's blog: in-house white-hat hackers had flagged issues beforehand; response lacked depth and speed.
• October 26. OANDA confirms unauthorized logins and trades. GMO Internet Group shares close down ¥590 at ¥3,179.
• October 27, morning. Minister Satsuki Katayama names five brokers reporting GMO-related customer losses: Goldenway Japan (FXTF), OANDA Securities, AvaTrade Japan, Gaitame Finest, Dukascopy Japan.
• October 27, 9:58 AM (7:58 PM CT Oct 26). Report No. 8 asks customers to back up, disconnect and unplug their PCs before noon.
• October 27, 12:30 PM (10:30 PM CT Oct 26). GMO confirms the attacker has posted information said to concern GMO and customers. Report No. 10 (1:55 PM): no ransomware attack confirmed.

What GMO has said

"A security problem existed in the Service's system, and we have confirmed unauthorized access to the Service's environment and that customer information was taken outside the company."

"We will not meet the attacker's demands, because paying would not guarantee that the stolen information is deleted or that its misuse is prevented."

What is still unknown

• How the attacker got in: component, vulnerability or credential.
• When access began.
• How many customers' credentials were taken, how many accounts were traded, and total losses.
• Which of the more than 70 firms named in the threat had customers affected beyond the five named.
• Whether any customer PC was reached through Remote Desktop drive redirection, as the attacker claims.
• Whether the data posted after the deadline is genuine.
• Whether Japan will apply its active cyber defense powers.
• Effect on GMO's earnings.

Confirmed by Cloudskope's direct observation (October 27, 1:56 to 2:20 AM CT)

• GMO's user guide on onamae-desktop.com says that when customers connect with the RDP file downloaded from the control panel, "file sharing is already configured in advance," along with USB printer use. In Remote Desktop terms this is drive redirection.
• GMO's site says it provides servers with MT4 from nine domestic securities companies pre-installed and recommends FXTF, one of the five brokers named by the minister.
• The product page carries the incident banner above unchanged copy promising "peace-of-mind security" and a "safe remote connection."
• onamae-desktop.com is served through Cloudflare with GMO-operated name servers; registered July 8, 2010.
• No GMO listing on the ransomware.live tracker.

Reported mechanism

GMO says unauthorized programs were installed on customer servers and that trading-tool login details saved there may have been obtained. Brokers attribute the unauthorized logins to credentials leaked from those servers. No entry vector has been disclosed.

Attacker claims (unverified)

Per Japanese security analysts and ITmedia: an Active Directory administrator account valid across servers; .rdp files with drive redirection on by default since 2019; cancelled servers left running. GMO says attacker statements may be partly false.

Technique mapping

• T1555 Credentials from Password Stores; T1078 Valid Accounts; T1657 Financial Theft.
• If the PC claims are true: T1021.001 Remote Desktop Protocol and T1199 Trusted Relationship.

Customer-side vendors belong in diligence when a target earns from them through affiliate fees, pre-installed software or referrals. Ask whether the target's strongest login control covers every channel into an account, including legacy desktop platforms and APIs. OANDA, one of the five brokers named, was owned by CVC Asia Fund IV until FTMO completed its purchase on December 1, 2025; nothing suggests the change is related, but buyers inherit every customer-side route into the platform.