Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand
Severity: high · Patch status: no-fix-needed · Since 2026-10-27
GMO Internet disclosed that attackers compromised its Onamae.com Desktop Cloud, a virtual desktop service marketed for foreign exchange trading, installing malware in some customers' server environments. Up to 26,739 VDI servers may be affected; attackers likely captured users' trading-service passwords, and some customers reported unauthorized transactions in their trading accounts. Customer information was exfiltrated. The attacker demanded $50 million; GMO refused to pay. CEO Masatoshi Kumagai admitted in-house white-hat hackers had previously flagged the vulnerabilities but remediation was too slow. GMO asked major trading services to terminate sessions and block trade requests from the cloud, is offering ¥5,000 condolence payments, will cover trading losses, and is providing a free alternative environment for six months while overhauling infrastructure with external experts.
What to do
- Change passwords for all trading accounts immediately, using a device not used for trading
- Disconnect all active sessions on securities/FX accounts or ask the provider's support desk to do so, since some apps keep sessions alive after password changes
- Monitor trading accounts for unauthorized transactions and report discrepancies to GMO and the trading service
- Stop using Onamae.com Desktop Cloud for trading until GMO's alternative environment and infrastructure overhaul are in place
- Assume customer data was exfiltrated and watch for phishing or misuse of personal information
Sources
All live incidents on Threat Watch
