GMO Internet takes down leak site as Japan and South Korea report new cyberattacks

A breach at GMO's cloud desktop service

GMO Internet Group, a Japanese technology conglomerate whose businesses span internet infrastructure, cybersecurity and financial services, disclosed on 20 October 2026 that it had suffered a cyberattack. The breach reached Onamae Desktop Cloud, a rented Windows desktop service used mainly by individual retail forex traders in Japan who run automated trading software. Malware was installed in some customer server environments, and up to 26,739 servers were at risk. GMO responded by shutting the servers down progressively, launching an investigation and cleaning them up.

Jiji Press reports that a cloud server used for automated foreign exchange margin trading suffered unauthorised access, and the company shut it down on 21 October. After receiving a threatening email, GMO reported the matter to the Tokyo Metropolitan Police Department on 22 October. Investigative sources say police are examining the extent of the damage, suspecting a violation of the law that prohibits unauthorised computer access, and are working partly through interviews with company officials.

Ransom demand and leaked data

The reported ransom figures differ between outlets. TechRadar says the attackers demanded roughly $50 million to delete the data, while The Independent reports a $1m ransom. GMO has refused to pay, saying there is no guarantee the stolen personal information would be deleted and warning that it could still be used for illegal activity. On Tuesday, 27 October, GMO confirmed that people believed to be behind the attack had published information it said was connected to the company and its customers, and said it was checking whether that material was authentic.

Early on Wednesday, 28 October, GMO confirmed that a website disclosing personal information believed to belong to a customer had been taken down, around 4 a.m., as it worked with other companies on the issue. Jiji Press reports that the site is believed to have been set up by the people behind the attack, and that GMO intends to act immediately against any similar sites. Reports have not said how many customers were compromised or which types of information were taken. An online post by the hacker group, cited by The Independent, said GMO was not engaging in negotiations and that the group would disclose the personal information.

Customers and the government response

GMO has told customers to scan their computers for viruses, back up their data, disconnect devices from the internet and shut them down. Some customer trading accounts have seen unauthorised transactions, and GMO has pledged to compensate customers for confirmed losses from them. Prime Minister Sanae Takaichi held an emergency meeting with other ministers and then told reporters:

“The situation is serious, with growing concerns about civil damages resulting from the misuse of leaked information. We must urgently strengthen our countermeasures.”

Takaichi asked her government to prepare a package of cybersecurity measures by early November. Bloomberg reports, citing Central Tanshi FX's Takayuki Tominaga, that Japan's retail forex market has largely shrugged off the attack, with trading volumes holding up even though some investors are closing accounts.

South Korea's financial firms

South Korea's financial sector has been hit by a fresh wave of attacks. Daishin Securities reported a cyberattack that exposed personal information of 38,490 customers, including names, email addresses and mobile phone numbers. The firm has notified affected customers, is cooperating with authorities and will compensate losses as required by law. Mirae Asset Global Investments and Bithumb reported separate cybersecurity incidents on Wednesday, according to local media, but neither has confirmed that customer data was taken.

The Financial Services Commission has called for stronger cybersecurity measures, and the government plans security checks on dozens of IT systems in the private sector. TechCrunch links the September wave of attacks on South Korea to a suspected China-based hacker who used an AI penetration testing tool called Artex, although officials are still investigating the root cause of the latest breaches. Investigators have not established a link between the Japanese and South Korean incidents. Bloomberg reports that Financial Supervisory Service Governor Lee Chan-jin also spoke about the breaches on Wednesday.