Japan's GMO says hackers posted data stolen from its Onamae Desktop Cloud, which serves about 27,000 servers
GMO says a suspected attacker posted claimed customer data on October 27, after refusing 8 billion yen then $1M ransoms; all 26,739 servers are down.
Japan’s GMO Internet confirmed at 12:30 on October 27 that a suspected attacker had posted data claimed to hold company and customer information — and the service at the center of it, Onamae Desktop Cloud (お名前.com デスクトップクラウド), has had every one of its 26,739 servers offline since the early hours of October 21. GMO’s tenth incident report, published the same day, says the posted content is still being verified and “may contain statements that differ from the facts”; the ransomware the attacker threatened has not appeared as of 13:44 that afternoon. GMO says it will not pay.
Key points
- The official timeline: intrusion confirmed October 20, when unauthorized programs were found in some customers’ server environments; all plans shut down in batches from 04:00 October 21; the data posting confirmed 12:30 October 27.
- The ransom moved twice: an initial demand of about 8 billion yen (roughly $50 million, deadline 17:00 October 21), then a reduced $1 million (about 160 million yen) expiring noon October 27. GMO refused both.
- GMO’s report warns that anyone who visits the leak site has their information collected by the attacker, and says the company is preparing civil disclosure requests and criminal complaints against malicious resharing.
Timeline of the incident
The dates below follow GMO’s and Onamae’s own announcements. Onamae’s October 21 notice states that on October 20 the company confirmed “a third party had installed unauthorized programs in some customers’ server environments,” and that all plans of the service would be shut down from 04:00 that day — 26,739 servers, with no restart date. Customers were told to change the IDs and passwords inside their servers immediately, to change any password reused elsewhere, and to watch for phishing mails impersonating the company. At that point Onamae said it had “not confirmed any leak of customers’ personal information or misuse of viewed information,” and that it does not store payment data, including credit card numbers.
TechCrunch’s report puts both the discovery and the shutdown on October 21, one day later than the official account of October 20; this entry follows the official notices.
| Date (2026) | Event | Source |
|---|---|---|
| Oct 20 | Unauthorized programs confirmed in some customer server environments | Onamae official |
| Oct 21, 04:00– | All plans shut down, 26,739 servers affected | Onamae official |
| Oct 21 | Ransom e-mail demanding ~¥8B received, deadline 17:00 same day | ITmedia |
| Oct 22 | Japan’s FSA tells FX brokers to harden account monitoring | Japanese media |
| Oct 24 | ¥5,000 condolence payment and loss-compensation policy announced | ITmedia |
| Oct 26 | GMO representative Kumagai publicly discloses the ransom demands | ITmedia |
| Oct 27, noon | Attacker’s deadline expires | ITmedia |
| Oct 27, 12:30 | GMO confirms data claimed as company and customer info was posted | 10th report |
| Oct 27, 13:44 | No ransomware attack observed | 10th report |
Ransom and refusal
The two ransom revisions run through the whole incident. Per ITmedia’s timeline, the attacker’s first e-mail on October 21 demanded $50 million (about 8 billion yen) by 17:00 that day; GMO refused. The demand then dropped to $1 million (about 160 million yen) with a new deadline of noon October 27, and a promise to publish customer data and deploy ransomware once it passed. On October 26, GMO representative Masatoshi Kumagai laid the demands out in a blog post.
Half an hour past the deadline, the tenth report confirmed that “a person believed to be the attacker has published material claimed to relate to the company and its customers.” The same report says the content may include false claims, and restates the company line: “We will not comply with the attacker’s demands.” If verification confirms customer personal data in the leak, GMO says it will contact affected customers individually and is considering additional payments beyond the flat ¥5,000 condolence money announced October 24.
The most practical warning in the report is aimed at bystanders: do not visit or reshare the posted data, because “the information of those who access the site is being collected by the attacker.”
What others say
International security coverage has centered on the tooling. TechCrunch, citing CrowdStrike, reports that an AI penetration-testing tool called Artex was used against South Korean financial institutions in September; citing Reuters, that its Chinese developer made it closed-source and stopped public updates after the bank-hack links surfaced; and citing Channel NewsAsia, that GMO’s own cybersecurity unit has tied Artex to attacks across Japan. The chain breaks there: GMO has not publicly linked Artex to this intrusion, and “the tool was used in attacks in Japan” and “GMO was breached” remain two separate facts.
Domestically, the incident reached financial regulation within a day of the shutdown. On October 22 the Financial Services Agency, via the Financial Futures Association of Japan, told FX brokers to strengthen monitoring of customer accounts and detect unusual IP connections and unnatural trading patterns immediately; the minister in charge said five domestic firms had reported customer damage. Traders are among the main users of hosted desktops, and after the shutdown the company received a wave of reports of unauthorized trades draining accounts — which is what the October 24 compensation policy responds to.
We covered Microsoft attributing the ConnectWise supply-chain intrusion to Storm-0940, which used the same ARTEX framework, and PingCAP confirming unauthorized access to its internal systems with up to 50,000 personal records exposed in Japan. All three leave readers in the same position: your data sits on someone else’s infrastructure, and the containment clock is not yours to set.
Our take
Two facts in this breach remain unsettled: whether the posted data is genuine, and whether the ransomware is still coming. GMO itself says the leak may contain false statements, so treating the circulating “leaked data” with distance is the reasonable read until credible verification lands — keep that access warning in mind, because being curious costs you your own connection metadata.
For anyone running critical workloads on a hosted desktop or managed cloud, three things here are actionable. A provider-side incident stops your whole fleet at once — 26,739 servers going dark together is now the reference case, and trading businesses in particular should know their downtime exposure in advance. Rotate credentials and stop reusing passwords across services; Onamae’s notice asks exactly that. And note GMO’s handling as a case study: numbered daily reports, a public refusal to pay, and an explicit warning about the risks of looking at the leak are not the standard playbook in incidents like this.
Still unknown: the intrusion path, who the attacker is, and what the leak actually contains. The FSA’s notice to the FX industry shows regulators are treating this as financial-infrastructure events go; if more firms report damage, the real scale may exceed what is public today.