Japanese internet and financial services giant GMO Internet Group has fallen victim to a sophisticated cyberattack targeting its Desktop Cloud service, operated under the popular Onamae.com brand. The security breach has placed up to 26,739 virtual private servers—frequently utilized by retail traders to run automated forex trading bots—at severe risk. In response to the crisis, company founder and CEO Masatoshi Kumagai has publicly appealed to the Japanese government to invoke the nation's newly enacted "active cyber defense" legislation.

The incident came to light after GMO detected malicious software compromising customer servers, prompting the company to execute a phased, emergency shutdown of all Desktop Cloud plans. While initial disclosures suggested that user financial data and payment credentials remained secure, subsequent investigations revealed that attackers successfully accessed login data tied to automated forex accounts, executing unauthorized trades. In response, GMO has pledged to fully cover verified customer losses.

The unidentified threat actors have reportedly issued extortion demands, threatening to leak sensitive corporate and customer data, launch massive ransomware campaigns, and continue manipulating brokerage accounts across more than 70 financial institutions in Japan and abroad. Rejecting the extortion outright, GMO refused to pay the ransom—noting that payouts guarantee neither data deletion nor safety—and instead turned over all evidence to law enforcement alongside external cybersecurity specialists.

The breach has ignited a fierce national debate over corporate accountability versus state-level intervention. CEO Masatoshi Kumagai called for the immediate application of Japan’s active cyber defense laws—which took effect on October 1 and empower authorities to locate and neutralize attacker servers abroad. However, critics and industry observers have noted that GMO may not fit the formal classification of critical infrastructure operators covered by the statute, with many accusing corporate leadership of attempting to deflect attention from internal security shortcomings and delayed patch management.

The fallout highlights deep-seated vulnerabilities in automated cloud setups, where shared administrator credentials or misconfigured local drive mappings can give intruders an open door. As investigations continue and affected users are advised to immediately secure their broker credentials and passwords, the incident stands as a major trial for Japan’s public-private cyber defense framework and a stark warning for cloud infrastructure providers worldwide.