Japan’s GMO Internet Group shut down 26,739 servers on its Onamae.com Desktop Cloud after an unauthorized access incident compromised user information and enabled fraudulent foreign exchange trades. Following an extortion demand and mounting industry security pressure, Masatoshi Kumagai announced cash compensation and goodwill payments for affected users.
GMO Internet Group Shuts Down Desktop Cloud Servers Following Security Breach
Following an unauthorized access incident that impacted thousands of rented server environments, the security crisis at GMO Internet has prompted an urgent appeal for the Japanese government to deploy active cyberdefense operations. Retail foreign exchange traders and automated strategy operators rent the Onamae.com Desktop Cloud infrastructure to keep MetaTrader platforms running around the clock. The company confirmed that customers’ information was taken outside of the service.
All plans across the Onamae.com Desktop Cloud service have been shut down since 04:00 Japan time on 21 October 2026. Rather than restarting the compromised platform, GMO confirmed it will offer customers a replacement service hosted on separate cloud infrastructure, which will be provided free of charge for six months. Details regarding the alternative service will be provided by 30 October.
Brokers Hold Withdrawals and Urge Password Resets as Unauthorized Trades Surface
Financial institutions operating in Japan reacted swiftly to the hosting compromise. OANDA’s Japanese brokerage held back withdrawals requested as a precaution against unauthorized payouts after warning that hackers may have accessed MetaTrader login credentials stored on the rented servers. The broker noted that client assets remained safely segregated under Japanese law. Withdrawals requested by 11:00 on Thursday were scheduled to be processed from 11:00 on Friday following security checks, aiming to reach client bank accounts by 16:00.
Other firms took similar defensive steps. Dukascopy Japan instructed all Virtual Private Server users to change their trading passwords immediately, citing unauthorized access at another company’s VPS service. In response to rising industry threats, other market participants have also tightened authentication protocols, such as IG’s Japanese unit making two-factor authentication compulsory by June 2026 and OANDA introducing mandatory authenticator codes for withdrawals in December 2025.
Japan's Onamae Cloud Cyberattack Puts 26,739 Servers at RiskA cyberattack on Japan's https://t.co/pXctyQSSd5 Desktop Cloud has triggered a widespread service shutdown, potentially affecting 26,739 servers.GMO Internet confirmed unauthorized access and the installation of… pic.twitter.com/oz7AFKwboD
Masatoshi Kumagai Announces Goodwill Payments and Rejects Extortion Demands
In response to the mounting fallout, GMO Internet leadership addressed the public directly. As Masatoshi Kumagai stated in a Sunday blog post, GMO Internet Group—a major provider of online financial services—will reimburse users for financial damages resulting from unauthorized access during a cyberattack on its foreign exchange trading platform, alongside a 5,000 yen ($32) goodwill payment granted to every customer.
The internet is increasingly being transformed into a tool that malicious actors use to threaten and rob people.
Masatoshi Kumagai, via Reuters
Kumagai added that response measures by private businesses alone are insufficient to eradicate skilled cybercrime organizations. The company confirmed it had received a demand for money from an individual believed to be responsible for the unauthorized access, accompanied by threats to publish information regarding GMO, its systems, and its customers, or launch a ransomware attack. GMO stated it would refuse the extortion demand because paying would not guarantee data deletion or prevent misuse, choosing instead to request a police investigation.
Against a slight increase in Tokyo’s benchmark index, GMO shares—which held a $2.6 billion market valuation at Friday’s market close—plummeted nearly 16% to reach a four-month low.
Active Cyber Defense Policy Debates and Government Response Measures
Seeking broader state intervention, GMO Internet made an urgent formal request for authorities to apply active cyber defense measures. The framework, which took effect on October 1, permits pre-emptive operations by the Self-Defense Forces and police to neutralize attacker servers by removing malware or disabling attack-command functions when core infrastructure is threatened.
Information gathering and overall coordination for the system are handled by the National Cyber Security Office, with prior approval from the third-party Cyber Communications and Information Oversight Committee required in principle. Commenting on the corporate appeal, a senior government official acknowledged GMO as an operator responsible for critical infrastructure but emphasized that measures are not triggered simply because a request is made, noting that the government independently determines whether criteria are met. Jun Osawa, a senior fellow at the Sasakawa Peace Foundation, noted that implementing measures based on a commercial request would be difficult because active cyber defense carries the character of a state counterattack, creating high diplomatic hurdles from foreign perspectives.