Japanese internet conglomerate GMO Internet is currently investigating a data breach involving its Onamae Desktop Cloud service, a platform that offers virtual desktops mainly used by financial traders. The company disclosed on October 27, 2026, that hackers gained unauthorized access and reportedly posted stolen customer data linked to its services. Although the authenticity and scope of the leaked information are still under verification, GMO has recommended that affected customers change their passwords due to unauthorized activity on some trading accounts. It is estimated that up to 27,000 servers could be impacted by this security incident.

The breach first came to light on October 21 when GMO Internet shut down Onamae’s cloud service after detecting the unauthorized access and receiving extortion demands amounting to approximately 8 billion yen, roughly $50 million. Over the following days, GMO reported the incident to Japanese law enforcement and initiated efforts to collect user devices for malware analysis and damage assessment. The company has pledged compensation and alternative offerings to customers while collaborating with government agencies to manage the fallout.

This event unfolded shortly after GMO’s cybersecurity unit detected evidence of a Chinese AI-enabled penetration testing tool named Artex being used in cyberattacks against Japanese firms. Although GMO has not officially linked Artex to the Onamae service breach, reports indicate that Artex exploits common security weaknesses such as inadequate multi-factor authentication. Similar attacks leveraging Artex targeted financial institutions in South Korea in September, leading to a recent decision by the tool’s developer to cease public updates and make it closed source amid growing concerns.

Japan’s Financial Service Agency has previously issued guidance in May 2026 urging firms to bolster their cybersecurity measures, emphasizing the importance of proactive defenses like vulnerability management and incident readiness. As cyber threats evolve, especially with the integration of AI-driven attack tools, regulators continue to encourage the adoption of advanced security technologies. GMO Internet’s latest incident underscores the ongoing challenges faced by critical cloud service providers in protecting financial sector clients from sophisticated cyber threats.