GMO Cloud Breach: Hackers Traded From Client Accounts

In short: In October 2026, attackers breached Onamae.com Desktop Cloud, a service run by Japan's GMO Internet. Up to 26,739 rented servers where traders ran MetaTrader terminals may be affected. The attackers stole brokerage logins, placed trades on users' accounts and demanded a $50 million ransom. GMO refused to pay and promised compensation.

What happened

GMO Internet is one of Japan's largest internet providers and domain registrars. Its Onamae.com Desktop Cloud service rents out remote Windows machines, and many traders use them to keep MetaTrader 4 and 5 terminals and trading bots running around the clock without relying on a home PC. Those machines also held the logins and passwords for brokerage accounts.

That is exactly what the attackers went after. They planted malware on customer servers, pulled out the credentials and started placing trades the account owners never made. We explain how malware harvests saved passwords and sessions in our guide to infostealers.

Timeline of the attack

• 19 October — the first customer reported suspicious activity.
• 20 October — GMO found malware on customer servers.
• 21 October — the company began shutting down every plan of the service in stages.
• 22 October — OANDA Securities Japan temporarily delayed customer withdrawals.
• 24 October — GMO announced a compensation plan.
• 27 October — the attackers' deadline to leak customer data and trigger ransomware. GMO told customers to disconnect and power down their PCs before noon.

What the attackers demanded

The attackers asked for ¥8 billion, about $50 million, in cryptocurrency. If GMO refused, they threatened to leak data on the company and its customers, launch ransomware and keep controlling trading accounts tied to more than 70 brokerage and forex firms in Japan and abroad. GMO refused to pay. The company says customers' payment details were not exposed and that the old platform will not be restored.

GMO has promised to reimburse confirmed losses from unauthorized trades, including fees, and to pay ¥5,000 to every customer regardless of losses. Claims for unauthorized trades are accepted until 6 November.

Why is storing passwords on a remote server risky?

A rented remote desktop is convenient: the terminal runs 24/7 and you can switch off your computer at home. But everything stored on it is entrusted to someone else's infrastructure. If the provider is breached, the saved passwords of thousands of customers are breached at once — even users who did everything right can lose out.

The main lesson for anyone trading through cloud servers, a VPS or remote access: that server is part of your security setup and deserves the same protection as access to your bank. We covered similar risks in our article on remote access scams.

How to protect your trading account

• Change your passwords for brokerage accounts and email — from a different, clean device, not from the server where they were stored.
• Turn on two-factor authentication in your broker's client area if it is available.
• Use an investor (read-only) password for bots and monitoring where your platform supports it, and keep the master password off machines that do not need it.
• Set withdrawal limits and a whitelist of payout details in your broker account if the option exists.
• Check login and trade history regularly. The sooner you spot a foreign trade, the easier it is to dispute.
• Keep passwords in a password manager, not in the terminal's autofill. See our password manager guide.

A word on VPNs, with honest limits: a VPN cannot protect a breached provider's server or bring back stolen passwords. Its role is the connection itself. When you reach a remote desktop or broker account from a café, hotel or other untrusted network, LiMP VPN encrypts the traffic so it cannot be intercepted on that network. More on protecting financial logins in our guide to secure online banking.

Sources

• BleepingComputer — Japan's GMO urges customers to shut down PCs amid ransomware threat
• FinanceFeeds — GMO says 26,739 cloud servers may be exposed, OANDA pauses withdrawals
• SecurityLab — Hackers threaten accounts at 70+ brokers (in Russian)