BTC
ETH
SOL
XRP
BNB
TON
DOT
LTC
POL
HBAR
NEAR
ARB
UNIGMO Internet says hackers breached trading cloud and threatened 70-plus brokerages
The Japanese group found malware in its Onamae.com Desktop Cloud service, which may have exposed 26,739 servers, and refused an extortion demand after alleged unauthorised trades on customer accounts.
Key points
- GMO confirmed malicious software in customer server environments on 20 Oct 2026, after a customer inquiry the day before.
- Attackers allegedly used stolen trading credentials and threatened accounts at more than 70 brokerages unless paid.
- GMO offered every Desktop Cloud customer a flat 5,000-yen payment from 24 Oct and pledged to cover verified losses.
GMO Internet says hackers breached its Onamae.com Desktop Cloud trading service, potentially exposing 26,739 servers and allegedly using stolen brokerage credentials to place unauthorised trades. The Japanese group found the intrusion after a customer inquiry on 19 Oct 2026, and confirmed malicious software in customer server environments by 20 Oct, according to Bitcoin.com News.
The platform keeps automated foreign exchange trading programmes such as Metatrader 4 and Metatrader 5 running around the clock, which left brokerage logins inside an environment the attackers had reached. GMO began shutting servers at 4 a.m. Japan time on 21 Oct and took the whole service offline. It later traced a flaw in its own systems that allowed unauthorised access and the removal of customer data.
The extortion demand was aggressive: the attackers threatened further unauthorised activity on accounts at more than 70 domestic and international brokerages unless GMO paid, and warned they would leak stolen information and launch more ransomware attacks. GMO refused, saying payment would not guarantee the data's return or an end to attacks, and brought in police and outside cybersecurity specialists. The 26,739 figure covers potentially exposed servers, not confirmed infections, and total damage is undetermined.
Founder Masatoshi Kumagai asked for government help under Japan's active cyber defence framework.
What to watch: The compromised infrastructure stays offline while investigators establish the number of affected accounts and the financial damage; GMO has submitted evidence to Japanese police.
Live updates on NewsFeeds:MacroDesk editor: Keshav Aggarwal (accountable for this page; this summary was not edited by hand)
How this was produced: an AI model wrote this summary of Bitcoin.com News’s report, which we credit and link above. Read our Editorial and AI policy. Spotted a mistake? See Corrections.
Not investment advice. Read the risk disclaimer.