Japanese internet firm GMO Internet is verifying a Japan data breach claim after suspected hackers posted information that appears linked to customers and its business, following unauthorized access to its Onamae cloud desktop service used by financial traders.
The company said on its blog that it believes an attacker has published that material, but the contents are still being checked and the full scale of the incident is not yet clear. GMO Internet has advised customers to reset their passwords after receiving reports of “unauthorized operations” on customer trading accounts. It also said about 27,000 servers may be affected by the breach.
Password resets and trading account risk
Onamae provides virtualized desktop access in the cloud, meaning traders work on remote machines rather than only on a local PC. After discovering unauthorized access, GMO shut the service and later told users to change passwords while it investigates whether posted files are genuine customer records.
The firm has offered customers compensation and alternative service, sought help from government agencies, and started collecting devices from customers to look for malware and better map the damage. It reported the incident to Japanese police shortly after the shutdown.
Timeline: what has happened so far
- 21 October: GMO Internet shut Onamae Desktop Cloud after finding unauthorized access and said it received an email from hackers demanding about 8 billion yen (around $50 million).
- 22 October: The company reported the incident to Japanese police and issued a further public update.
- 24 October: GMO said it would offer customers compensation and alternative service while seeking help from government agencies.
- 25–26 October: The firm began collecting devices from customers to detect malware and assess the harm.
- 27 October: GMO said a suspected attacker had posted information that appeared linked to the company and its customers, and that it was still checking whether the material was genuine.
Wider warnings, and the Artex question
The Japan data breach comes about a week after GMO’s cybersecurity unit separately said it had found evidence that a Chinese AI-enabled penetration-testing tool called Artex had been used in hacks aimed at companies across Japan. GMO has not publicly established a link between Artex and the Onamae incident.
According to cybersecurity firm CrowdStrike, Artex was also used against financial institutions in South Korea in September, with attacks often relying on weak basic controls such as missing multi-factor authentication. The tool’s Chinese developer later stopped public updates and made Artex closed-source after it was tied to bank-targeted attacks.
A spokesperson for Japan’s Financial Services Agency (FSA), the country’s financial regulator, said the agency issued guidance in May urging financial institutions to prepare for a rise in cybersecurity weaknesses. The FSA called for stronger basics—including vulnerability management, layered (“defense-in-depth”) protections, and incident preparedness—while encouraging firms to use AI and other security tools.
Aasan alfaaz mein
Japan ki bari internet company GMO ke Onamae cloud desktop par unauthorized access hua hai. Company keh rahi hai ke suspected hackers ne gahak aur business se related data online dalne ka ilzam lagaya ja raha hai, lekin woh abhi check kar rahi hai. Taqreeban 27,000 servers mutasir ho sakte hain, aur gahakon ko password badalne ka mashwara diya gaya hai. Trading accounts par unauthorized operations ki reports bhi aayi hain, is liye jinhon ne yeh service use ki unhen company ke updates follow karne chahiye.
