Unauthorized Access to Onamae.com Desktop Cloud Affects Customer Information and Accounts

The investigation began on October 19, 2026, following a customer inquiry, and on October 20 GMO Internet confirmed that a third party had installed malicious programs in Onamae.com Desktop Cloud server environments. From 4:00 a.m. on October 21, the company began progressively suspending servers across all plans. The exact date on which the unauthorized access began has not been disclosed.

The potential scope covers 26,739 servers, a figure the company clarified does not represent confirmed cases of access or data extraction. Stored information could include trading-account credentials, and some customers reported transactions they did not recognize; GMO later confirmed that customer information had been taken from its systems. The company kept the service suspended, asked customers to change passwords and close sessions, engaged external specialists and the police, and announced a payment of JPY 5,000 to each customer as well as compensation for confirmed losses from unauthorized trades.

The latest official status, updated on November 4, 2026, states that the investigation and verification of information remain ongoing. The domain used to publish data attributed to customers was suspended on October 28, and analysis of devices provided by customers had found no traces of infection or ransomware attacks. GMO began contacting customers about payments and alternative services, continues to cooperate with the authorities, and has not announced a date for resuming the service.