GMO Internet to compensate customers after cyberattack on cloud service Onamae.com Desktop Cloud

What happened

The Japanese internet company GMO Internet announced on Saturday that it will compensate customers for losses from unauthorized transactions following a cyberattack on its cloud service Onamae.com Desktop Cloud — virtual private servers for remote desktop access. According to the company, customer data was stolen, and some users found trades on their trading accounts that they had not made. Founder and CEO Masatoshi Kumagai said that the incident potentially affected 26,739 servers and led to unauthorized operations on accountsopened at more than 70 securities and foreign exchange companies in Japan and abroad.

Company and market reaction

The investigation began on October 19 after a customer report. On October 20, GMO confirmed the installation of malware in part of the customer server environments, suspended acceptance of new applications and access to the control panel, and the next day began shutting down all servers. On Saturday, the company promised to compensate losses from unauthorized trading and to pay all current customers of the service a goodwill compensation of 5,000 yen (28 euros) — regardless of whether they suffered financial losses. GMO shares fell almost 16% on Monday to a four-month low; the company's market value at the close of trading on Friday was about $2.6 billion.

Ransom demand and admission of mistakes

GMO said it received a ransom demand from the party believed to be behind the attack. In an updated blog post on Monday, Kumagai clarified: the attackers demanded $50 million in cryptocurrency and threatened to publish company and customer data. The company refused to pay and is cooperating with the police. On Sunday, Kumagai apologized for the company's response and acknowledged that its security specialists had identified problems even before the incident, but the measures taken proved insufficient. Customers who wish to continue working in a Windows desktop environment will be offered an alternative service on independent cloud infrastructure free of charge for six months; a redesign of the security architecture and an investigation into the causes of the incident with external experts are also planned.

Context and call to the state

Kumagai called on the Japanese government to strengthen active cyber defense measures, saying that private companies cannot counter sophisticated cross-border attacks on their own. GMO asked the authorities to consider applying this mechanism to the incident and provided investigators with evidence and technical information. The attack occurred amid concerns following the disclosure last week of two critical vulnerabilities in PHP — a language widely used for building websites and applications: security agencies warned that these vulnerabilities allow malicious code to be executed on servers, prompting organizations worldwide to install updates or temporarily shut down services. However, GMO has not publicly confirmed a link between the PHP vulnerabilities and the attack on its service. Separately, it is noted that last week a Google Cloud outage in the UK disrupted online services, including the fintech company Revolut, demonstrating the domino effect of digital infrastructure failures.

Why it matters

The incident shows that the compromise of a single cloud provider can affect the financial accounts of customers of dozens of companies — in this case, more than 70 brokerage and foreign exchange firms. For users, this means concrete measures: a payment of 5,000 yen to all customers of the service, compensation for losses from unauthorized trades, and a free alternative service for six months. For the industry, the signal is that even security problems identified in advance do not guarantee protection if the response, as GMO's own leadership admitted, proved insufficient.