The key facts

  • On October 27, GMO announced that an attacker had published data allegedly related to the company's customers and business
  • The Onamae Desktop Cloud service was shut down on October 21 after unauthorized access was detected; the hackers demanded about 8 billion yen (~$50 million)
  • Up to 27,000 servers may be affected; customers have been advised to reset their passwords

What happened

Japanese internet company GMO Internet is investigating a data leak following an alleged unauthorized access to its cloud virtual desktop service Onamae Desktop Cloud, which is used by financial traders. As TechCrunch reports , citing the company's blog, on October 27 GMO announced that an attacker had published information allegedly related to the company's customers and business, but its authenticity is still being verified, and the full scope of the incident remains unclear. A GMO spokesperson did not respond to TechCrunch's request for comment.

Timeline of the incident

On October 21, GMO shut down the Onamae Desktop Cloud service, having discovered unauthorized access to its systems, and received a letter from hackers demanding a ransom of about 8 billion yen (~$50 million). On October 22, the company reported the incident to the police; on October 24, it promised customers compensation and an alternative service and sought help from government agencies; on October 25–26, it began collecting customers' devices to search for malware, and on October 27 it announced the publication of data. According to the company's estimate, the breach may affect up to 27,000 servers; customers have been advised to reset their passwords amid reports of 'unauthorized transactions' on trading accounts.

Connection to the Artex tool

The incident occurred about a week after GMO's cybersecurity division reported that the Chinese AI pentesting tool Artex was being used in attacks on companies across Japan. However, no link between Artex and the Onamae breach has been publicly established. According to a CrowdStrike report, Artex was used in September in attacks on financial institutions in South Korea, which mostly relied on weak security measures — for example, the absence of multi-factor authentication. As Reuters reports, the Chinese developer of Artex subsequently stopped public updates and made the tool closed-source. Japan's regulator, the FSA, told TechCrunch that as early as May it had recommended that financial organizations strengthen basic protections — vulnerability management, layered defense, and incident readiness.