Hackers breached the Onamae.com Desktop Cloud service of GMO Internet Group, which was used by traders for 24/7 Forex trading. The service has been shut down, and the company has confirmed a customer data leak. A total of 26,739 servers are at risk; losses of ¥4.16 million (~$27,000) and nearly ¥3 million were recorded within seconds. Today, CEO Masatoshi Kumagai acknowledged that vulnerabilities were closed too slowly.

Funds lost through trading robot access

Traders rented servers on Onamae for automated trading, where robots operated with access to brokerage accounts. Attackers exploited these credentials to execute loss-making trades instead of withdrawing funds.

Ransom demand and threats to over 70 brokers

The hackers are demanding a ransom and threatening to continue draining client funds at more than 70 brokers, leak stolen data, and infect affected users' computers with ransomware.

GMO refused to pay and promised compensation

The company has refused to pay, contacted the police, and promised to compensate verified client losses; the service has been suspended and the data leak confirmed.

Internal warnings and rise in AI-driven attacks

According to Masatoshi Kumagai, internal white-hat hackers had warned about vulnerabilities in advance, but they were addressed too slowly. As he stated, "the internet itself is already starting to break down" due to the rapid increase in AI-driven attacks.