--- title: GMO Internet: attackers broke into Onamae.com Desktop Cloud, a Windows VPS popular for running MT4/MT5 trading bots, stole stored broker logins and are placing unauthorized trades at 70+ brokers | ctxsec url: https://ctxsec.com/items/gmo-onamae-desktop-cloud-breach-fx-account-takeover-extortion description: "" status: "confirmed (GMO Internet reports 1-4, Oct 21-24); data exfiltration and extortion confirmed by GMO; 26,739 is servers possibly affected, not confirmed victims; 5th report Oct 24 asks customers to scan their own devices, last updated Oct 26, 2026, 8:05 AM ET" published: 2026-10-25 updated: 2026-10-26T08:05:00-04:00 --- > [← Cybersecurity News](/news) · [markdown](/items/gmo-onamae-desktop-cloud-breach-fx-account-takeover-extortion.md) confirmed (GMO Internet reports 1-4, Oct 21-24); data exfiltration and extortion confirmed by GMO; 26,739 is servers possibly affected, not confirmed victims; 5th report Oct 24 asks customers to scan their own devices 2026-10-25 · updated Oct 26, 2026, 8:05 AM ET ### GMO Internet: attackers broke into Onamae.com Desktop Cloud, a Windows VPS popular for running MT4/MT5 trading bots, stole stored broker logins and are placing unauthorized trades at 70+ brokers **Update Oct 26:** in an addition dated Oct 26 to his blog post, GMO group CEO Masatoshi Kumagai discloses that the attacker also demanded **$50 million (about ¥8 billion)** from the company. Japanese press citing the demand letter say it came at **11:57 JST on Oct 21**, asking for payment in Bitcoin or Ethereum by 17:00 the same day. GMO says it has not complied and has paid nothing. Separate attacker posts claiming Active Directory misconfigurations, shared admin credentials and a new deadline are unverified attacker claims. **Update Oct 24-25:** in its **fifth report** GMO asks every customer to run a full antivirus scan of their **own PCs and phones** and back up their data, saying its investigation now covers effects on customer devices and calling this a preventive step. It repeats that changing a broker password may not end existing sessions, asks customers to also change any password saved in the server's browser or reused elsewhere, and warns not to open links or files in messages from anyone claiming to be the attacker. On Oct 25 group CEO Masatoshi Kumagai published a blog post on why GMO asked the government to use its new active cyber defense powers. GMO Internet says a third party planted malicious programs in customer servers on its **Onamae.com Desktop Cloud** service (Windows desktops in the cloud, widely used in Japan to run MT4/MT5 forex trading tools around the clock). In its **Oct 24** fourth report it confirms a security problem in the service's own systems, unauthorized access and that **customer information was taken out**. - **Timeline:** customer inquiry Oct 19; malicious programs confirmed Oct 20 (sign-ups and control panel halted); all plans shut down from Oct 21 4:00 JST; police consulted Oct 22. - **Scope:** **26,739** servers possibly affected (GMO stresses this is not a count of confirmed intrusions). At risk is anything customers stored on the servers, including trading-tool logins. GMO does not hold card data on the service. - **Fraud:** customers report trades they did not make. GMO says the attacker threatened to keep manipulating accounts at **more than 70 brokerages and FX firms**, leak data on the service and connected customer PCs, run ransomware, and publish details of GMO's systems. GMO refuses to pay and has asked brokers to block access from the service and force-disconnect all sessions. - **Response:** the old platform will not be restarted. GMO will pay every current customer ¥5,000, cover verified realized losses from unauthorized trades, and offer a separate replacement platform free for six months. GMO says it has asked government bodies about measures under Japan's new active cyber defense framework. If you ran anything on this service: from a different device, change every broker and trading-tool password, end all active sessions with each broker (a password change alone may not cut existing sessions), turn on 2FA, change any credentials saved in the server's browser, and check trade history. Watch for phishing that pretends to handle refunds. Sources: [Masatoshi Kumagai blog (Kumagai.com), with Oct 26 addition on the $50M demand (Japanese)](https://www.kumagai.com/?eid=19600) · [Yomiuri: GMO was asked for about ¥7.9 billion by the attacker (Oct 26, Japanese)](https://www.yomiuri.co.jp/national/20261026-GYT1T00290/) · [GMO Internet: 5th report, renewed request to customers (Oct 24 15:00 JST, Japanese)](https://internet.gmo/news/article/250/) · [GMO Internet: group CEO Masatoshi Kumagai blog on the incident and active cyber defense (Oct 25, Japanese)](https://internet.gmo/news/article/251/) · [GMO Internet: 4th report on the Desktop Cloud cyberattack (Oct 24, Japanese)](https://internet.gmo/news/article/249) · [GMO Internet: 3rd report, timeline and scope (Oct 23, Japanese)](https://internet.gmo/news/article/248/) · [Onamae.com notice: server shutdown from Oct 21 4:00 JST (Japanese)](https://www.onamae.com/news/article/11584/)