Short answer

GMO Internet Group said attackers broke into its Onamae Desktop Cloud service in October 2026 and demanded about 8 billion yen (roughly $50 million). The company refused to pay. Attackers then published data that GMO says it is verifying.

If you think your details were included, start with our checklist on what to do after a data breach.

Key facts

Key facts about the GMO Internet Group incident
OrganizationGMO Internet Group
Incident typeExtortion
StatusConfirmed by the organization
SectorWeb hosting and internet services
CountryJapan
Detected2026-10-20
Disclosed2026-10-26
People or records affectedUp to 26,739 customer servers could have received malware (GMO's estimate); the number of customers whose data leaked is not confirmed

What data was exposed

  • Company and customer data published by the attacker (authenticity being verified by GMO)
  • MetaTrader 4 and 5 credentials and trading account details (possible)
  • Payment information reported as not exposed

What happened

GMO Internet Group, a large Japanese web services company, said an intrusion into its Onamae Desktop Cloud service was detected on 20 October 2026. The service provides virtual desktops, many used by traders. BleepingComputer reports the attacker could have placed malware on up to 26,739 customer servers.

GMO said payment information was not exposed. It said MetaTrader 4 and 5 credentials and trading account details may have been exposed. BleepingComputer reports that company and customer data was later published online.

The ransom demand

The attacker demanded about 8 billion yen, roughly $50 million, according to BleepingComputer. GMO refused. On 26 October the company warned that the attackers planned to leak data and trigger a ransomware payload planted on customer servers.

Reports differ on timing. BleepingComputer dates detection to 20 October, while IBTimes UK, citing a TechCrunch timeline, puts the service shutdown and the first demand on 21 October. IBTimes also reports a later, smaller $1 million demand that GMO told NHK it would not pay. We could not confirm that figure elsewhere.

Timeline

  • 20 to 21 October: intrusion detected, service shut down.
  • 22 October: reported to Japanese police.
  • Date not given in our sources: GMO announced compensation. BleepingComputer says it offered 5,000 yen (about $30) per customer.
  • 26 to 27 October: GMO warned of a leak and told customers to disconnect their PCs from the internet and shut them down.
  • 27 October: the attacker published data that GMO said it was verifying.
  • 28 October: IBTimes says the publishing domain was taken down, but replacement sites could appear.

The leak and what is unverified

IBTimes reports the published customer details have not been authenticated. BleepingComputer says no ransomware appears to have activated on customer machines. The number of customers whose data leaked is not confirmed.

Staying safe

Leaked trading details and contact information invite follow-up fraud. Learn how to spot phishing messages, and read our guide on investment scams if anyone approaches you about trading. If someone demands payment to keep your data private, see urgent payment scams and the data breach checklist. More incidents are listed on the breaches page.

What is still unknown

How the attackers got in, how many customers were hit and whether the leaked files are genuine all remain open.

Scams to watch for after this breach

Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.

  • Fake GMO or Onamae emails and texts about 'compensation' that ask you to enter card or bank details.
  • Phishing that claims your trading account was compromised and asks for MetaTrader 4 or 5 logins.
  • Blackmail messages from people claiming to hold your leaked data and demanding payment.
  • Scam trading platforms that target people whose trading details were exposed.

What to do if you are affected

  1. 01Follow GMO's official instructions from its own website only. Do not act on links in unsolicited messages.
  2. 02If you use MetaTrader 4 or 5 on an affected service, reset your passwords, end all active sessions and check your account for trades you did not make.
  3. 03Follow GMO's guidance on disconnecting and shutting down affected PCs.
  4. 04Do not pay or reply to anyone who claims to have your leaked data. Report the message to GMO and to police.
  5. 05Do not share or download the leaked material. GMO has said it will seek removal of replacement sites that publish it.

Frequently asked questions

Was my data in the GMO Internet breach?

Only customers of the Onamae Desktop Cloud virtual desktop service are in scope. BleepingComputer reports company and customer data was published, and GMO says it is verifying the material. Check GMO's official notices for your service.

Did GMO pay the ransom?

No. BleepingComputer reports GMO refused the demand of about 8 billion yen (about $50 million) and has said it will not pay the attackers.

Is the leaked GMO data real?

IBTimes says the published details have not been authenticated. GMO said it is verifying whether the data is genuine.

Is it safe to keep using GMO's Onamae Desktop Cloud?

GMO shut down the service on 21 October, according to IBTimes, and has told customers to disconnect and shut down their PCs. Follow its current instructions and change any trading passwords.

Sources

  1. Japan's GMO urges customers to shut down PCs amid ransomware threat, BleepingComputer, 2026-10-27
  2. Japan's GMO Internet Group Faces Daily Leak Threats After Refusing Ransom, Purported Customer Data Appears Online, IBTimes UK

This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.