GMO Cloud Breach: Data Leak Claims, ¥5,000 Payments and Trader Risks

GMO Cloud Breach: 26,739 Servers, Data Leak Claims and Compensation

A cyberattack on a Japanese hosting service used for automated trading has turned into one of the biggest security stories of the week. 

The GMO Cloud breach hit Onamae.com Desktop Cloud, a rented-server service where traders run tools such as MetaTrader. 

It is a traditional finance incident, not a crypto exchange hack, but the lessons apply to anyone who runs trading bots on remote servers. 

Here is a clear timeline of what is confirmed and what customers should do.

Source: X Post On GMO

What Happened and When

GMO Internet confirmed on 20 October 2026 that a third party had installed malicious programs in the server environments of some customers. 

In its first official report, the company said 26,739 servers were potentially affected and began shutting down all plans in sequence from 4:00 JST on the 21st. 

At that stage the company had not confirmed any leak of personal information, a position later reports changed.

What Was Exposed

A second report widened the picture. Customers reported unauthorized actions on their trading accounts, and login details saved in trading tools, such as MT4 and MT5 passwords, may have been viewed. 

Customers were told to change passwords from a different device, log off, check balances, and turn on two-factor authentication if their broker offers it. The company does not store payment card data on these servers.

Compensation and a Government Request

By 24 October, a fourth report confirmed that the systems had security weaknesses, that the environment was accessed without permission, and that customer information was taken outside the company. 

The GMO Cloud breach also touched accounts at more than 70 securities and FX firms in Japan and abroad.

• A flat ¥5,000 goodwill payment to every current customer, regardless of loss

• Compensation for realized losses from confirmed unauthorized trades, including fees

• Market swings and lost potential profits are not covered

• Details of how to apply are due by 6 November

The company acknowledged its shortcomings and promised to take responsibility for compensation and for preventing a repeat. 

It also asked the government to apply Active Cyber Defense, a framework in which authorities act against attackers’ infrastructure, calling this the first case it believes should trigger it.

Ransom Demand and Device Checks

The ninth report adds that a threatening email on the 21st demanded about ¥8 billion, roughly $50 million by our own estimate. 

The reports do not say the demand was in crypto. The company refuses to pay, arguing that payment would not guarantee deletion of stolen data. 

After a call for cooperation on 25 October, employees visited customers nationwide to take custody of devices for analysis by an in-house white-hat hacker team, and as of 27 October, no malware, including ransomware, had been found on the devices checked so far. 

That is not proof that every device is safe. Security firms such as Trend Micro have offered help, and customers hit by ransomware will receive a replacement PC of equal performance.

Latest Update: Attackers Publish Data

In its tenth report, the company confirmed that people believed to be the attackers published what they claim is company and customer data at 12:30 on 27 October. The content is being checked and may contain false details. 

The company is preparing legal action, including criminal complaints, against those who spread malicious information. 

As of 13:55, no ransomware attack had been confirmed. Customers whose data appears will be contacted individually, and a separate sympathy payment is under discussion. 

Anyone following the GMO Cloud breach should avoid the claimed leak site, because visitors’ information can be collected.

What customers should do now:

• Run a full antivirus scan and back up important data

• Disconnect the PC from the network and power it off

• Change every password reused elsewhere

• Ignore messages offering to “recover losses."

• Trust only the company’s official page for updates

Conclusion

The GMO Cloud breach shows how one compromised hosting service can expose many traders at once. 

Confirmed facts include 26,739 potentially affected servers, a compensation plan, a refused ransom demand, and a data publication on 27 October. 

Still unknown are the full number of victims and total losses. Traders who run bots remotely should use unique passwords, limited permissions, and two-factor authentication. This article is not financial advice.

Disclaimer

This article is for educational and informational purposes only and is not financial or investment advice. Crypto assets are high risk, their prices can be very volatile, and you can lose some or all of your money. Always do your own research and consider speaking with a licensed financial advisor before making investment decisions.