GMO Internet Says Hackers Published Stolen Data After $50 Million Demand

Hackers demanded roughly 8 billion yen — about $50 million — from GMO Internet after breaking into its Onamae Desktop Cloud service, and the Japanese internet giant now says the attackers have published data linked to its customers. The disclosure landed October 27, six days after the company first pulled the plug on the service.

GMO Internet, one of Japan's largest IT and internet services firms, said in a blog post that it believes the attacker published information allegedly tied to customers and its business. The contents are still being verified, and the full extent of the incident remains unclear.

The stakes are substantial. The company said 27,000 servers may be affected by the breach. Onamae's cloud desktop product serves virtualized desktops to financial traders — a user base that handles money in real time. GMO has already received reports of "unauthorized operations" performed on customer trading accounts, and it has advised all customers to reset their passwords.

A spokesperson for GMO Internet did not respond to TechCrunch's request for comment.

What happened, day by day?

The breach moved fast. Here is the timeline GMO has disclosed:

• Oct. 21: GMO Internet shut down Onamae Desktop Cloud after discovering unauthorized access to its systems. The same day, the company received an email from hackers demanding about 8 billion yen (~$50 million).
• Oct. 22: The company reported the incident to Japanese police and shared a second public update.
• Oct. 24: GMO said it would offer customers compensation and an alternative service, and that it was seeking help from government agencies.
• Oct. 25–26: The company began collecting devices from customers to detect malware and size up the damage.
• Oct. 27: GMO said a suspected attacker had posted information appearing linked to the company and its customers, and that it was still verifying whether the data was genuine.

Is a Chinese AI hacking tool involved?

Maybe — and GMO itself raised the question. About a week before the breach disclosure, the firm's cybersecurity unit separately reported evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan. The company said it has not publicly established a connection between Artex and the Onamae breach.

Artex has form. CrowdStrike reported earlier this month that the tool was also used to hack financial institutions in South Korea in September. Those attacks largely relied on exploiting weak security controls, such as a lack of multi-factor authentication. According to Reuters, Artex's Chinese developer has since stopped public updates and made the AI security tool closed-source after it was linked to cyberattacks targeting banks.

The common thread is basic hygiene, not exotic capability: where MFA and defense-in-depth were absent, the tool got in.

What is Japan's regulator doing?

A spokesperson at Japan's Financial Services Agency told TechCrunch the regulator issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities. The FSA called for stronger basic defenses, including "vulnerability management, defense-in-depth and incident preparedness," while encouraging firms to use AI and other security tools.

That guidance now reads as prescient. A breach at a vendor supplying virtualized desktops to traders puts the regulator's warning squarely to the test — and puts GMO's compensation offer, device collection effort and police report under fresh scrutiny.

The open question is scale: until GMO verifies the published data and completes its malware sweep across those 27,000 potentially affected servers, nobody — including GMO — knows how many trader accounts were actually touched.