GMO Internet says hackers posted customer data from its Onamae cloud desktop service

Japanese internet services group GMO Internet has acknowledged that hackers appear to have published data stolen from Onamae, its cloud desktop service for financial traders. According to TechCrunch, the company said in a blog post that a suspected attacker had posted information that seems connected to its customers and its business, though GMO is still verifying whether the material is genuine and says the full scope of the incident remains unclear.

The disclosure is the latest step in a breach that began less than a week earlier. GMO has already advised all customers to reset their passwords after receiving reports of unauthorized activity on customer trading accounts, and the company says as many as 27,000 servers may be affected. A spokesperson for GMO did not respond to a request for comment from TechCrunch.

A rapid sequence of events

The timeline reported by TechCrunch shows how quickly the situation escalated:

• October 21: GMO took the Onamae Desktop Cloud service offline after discovering that its systems had been accessed without permission. The same day, the company received an email from the hackers demanding roughly 8 billion yen, about $50 million.
• October 22: The incident was reported to Japanese police, alongside a further public update.
• October 24: GMO said it would provide compensation and an alternative service to customers while seeking assistance from government agencies.
• October 25 and 26: The company began collecting devices from customers to check for malware and better understand the damage.
• October 27: GMO said a suspected attacker had published information apparently linked to the company and its customers.

A possible link to an AI-powered hacking tool

The breach follows a separate finding by GMO's own cybersecurity unit, which roughly a week earlier reported evidence that Artex, a Chinese AI-enabled penetration testing tool, had been used in attacks on companies across Japan. GMO has not publicly established any connection between Artex and the Onamae breach, according to TechCrunch.

Artex has a documented track record. CrowdStrike reported this month that the tool was used against financial institutions in South Korea in September, with the attacks largely exploiting weak security controls such as the absence of multi-factor authentication. Reuters reported that Artex's Chinese developer halted public updates and made the tool closed-source after it was linked to cyberattacks on banks.

Regulators push basic defenses

Japan's Financial Services Agency told TechCrunch that it issued guidance in May urging financial institutions to brace for a rise in cybersecurity vulnerabilities. The regulator called for stronger fundamentals, including managing vulnerabilities, layering defenses and preparing for incidents, while encouraging firms to adopt AI and other security tools.

Why it matters

The target here matters as much as the breach. Onamae provides virtualized desktops used by financial traders, so a compromise is not just a data leak: reports of unauthorized activity on trading accounts suggest the attackers may have reached financially sensitive operations. The device collection now under way also indicates GMO suspects malware may have spread to customer endpoints, not only its own infrastructure.

The scale, with up to 27,000 servers potentially affected, a roughly $50 million ransom demand and stolen data now published, makes this one of the more serious security incidents at a major Japanese provider in recent memory. The backdrop of Artex, an AI-assisted tool whose operators exploited missing multi-factor authentication, reinforces a point regulators keep making: basic hygiene such as MFA and layered defenses is often the difference between a near miss and a headline breach.