Skip to content
NewA calmer, faster ZeroHour
StoryRansomwarehigh

GMO refuses ransom after Onamae trading-desktop breach

8 sources · 8 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

GMO has shut Onamae Desktop Cloud, refused about ¥8 billion, and says posted data is still unverified while ransomware was not confirmed.

GMO Internet found malicious programs on some Onamae.com Desktop Cloud servers on October 20 and suspended the foreign-exchange virtual-desktop service on October 21. It says up to 26,739 servers may be affected, customer information was taken, and trading passwords may have been seen; payment data was not exposed, according to BleepingComputer. An email demanded about ¥8 billion, roughly $50 million, and threatened publication and ransomware at noon Japan time on October 27. GMO refused, notified police on October 22, and says ransomware was not confirmed. Alleged company and customer files later appeared online and remain unverified. Customers were told to disconnect and power off PCs, reset trading passwords from a clean device, and GMO offered ¥5,000 plus coverage of attack-related trading losses.

Key facts
  • Potentially affected servers: 26,739, not confirmed infections.
  • Ransom of about ¥8 billion was refused; ransomware was not confirmed.
  • MetaTrader 4 and 5 credentials may have been exposed; payment data was not.
  • GMO offered ¥5,000 and said it would cover unauthorized trading losses.
  • On October 28 GMO offered up to $1 million for tips leading to arrest.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026GMO finds malware on some customer servers. · BleepingComputer
  2. Oct 21, 2026Service suspended after roughly ¥8 billion ransom email. · TechCrunch
  3. Oct 22, 2026GMO notifies Japanese police. · TechCrunch
  4. Oct 25, 2026GMO begins collecting customer devices for malware checks. · TechCrunch
  5. Oct 27, 2026Alleged data posted; ransomware not confirmed. · Cyber Security News
  6. Oct 28, 2026GMO opens bounty of up to $1 million. · The Hacker News

What each outlet adds

beyond the shared facts
  • The RegisterCEO cited slow fixes; brokers asked to end sessions.
  • TechCrunchNo link to Artex; device collection began October 25.
  • BleepingComputerTrend Micro assisting; MetaTrader credentials may be exposed.
  • The Hacker NewsBounty terms through October 2027; OANDA linked unauthorized trades.
  • Infosecurity MagazinePuts the ransom at about $50.7 million.
Vendors
GMO Internet GroupGMO Internet
Products
Onamae.comOnamae.com Desktop CloudMetaTrader 4MetaTrader 5Onamae Desktop CloudArtexARTEX
Victims
GMO InternetGMO Internet GroupOANDA JapanGMO Group
Organizations
FXTFTrend MicroFinancial Services AgencyCrowdStrike
Countries
Japan

Coverage

oldest first · one row per article · UTC
  1. · 3d ago The Register · SecurityFirst report

    GMO's Onamae.com Desktop Cloud breached; attacker demands $50 million

    GMO says up to 26,739 VDI servers may be affected, trading passwords were exposed, and it will not pay.

  2. · 3d ago TechCrunch · Security

    GMO says attackers posted data from Onamae desktop breach

    The firm shut the trading desktop service on October 21 after a roughly $50 million ransom demand and now advises password resets.

  3. · 2d ago BleepingComputer

    GMO urges Onamae customers to shut down PCs over ransomware threat

    GMO says data was posted after an October 20 intrusion that may have hit 26,739 servers; it refused an ¥8 billion ransom and says encryption did not run.

  4. · 2d ago Cyber Security News

    GMO tells Onamae.com users to shut down PCs after extortion threat

    Attackers demanded about ¥8 billion; alleged data appeared online, but GMO has not confirmed ransomware.

  5. · 2d ago The Hacker News

    GMO offers $1 million bounty after Desktop Cloud breach

    Attackers demanded about $50 million after malware and customer data theft; trading logins were abused at brokers.

  6. · 2d ago GBHackers

    GMO Internet warns Desktop Cloud customers after ransomware threat

    Attackers demanded about ¥8 billion after unauthorized access; GMO says no ransomware was confirmed by October 27.

  7. · 2d ago DataBreaches.net

    GMO tells customers to disconnect PCs after breach and ransomware threat

    The company said up to 26,739 servers were at risk after malware was found on some customer environments.

  8. · 2d ago Infosecurity Magazine

    GMO Internet tells Onamae.com customers to disconnect PCs after breach

    As many as 26,739 servers may be affected; GMO refused a ransom of about 8 billion yen and has not found ransomware on devices checked so far.