Key facts
- Hacker posted alleged customer information after GMO refused a ransom demand.
- The breach affected GMO's Onamae.com Desktop Cloud service.
- The attackers demanded $50.8 million in cryptocurrency.
- GMO confirmed unauthorized access and exfiltration of customer information.
- Five Japanese FX brokers reported customer impact.
A hacker has posted what they claim is customer information from GMO Internet Group after the Japanese internet provider refused to pay a ransom demand. The disclosure came on Tuesday afternoon, October 27, 2026, after the attackers threatened to release data by noon if their demands were not met. The unauthorized access targeted GMO's Onamae.com Desktop Cloud service, which is used for foreign exchange trading and other purposes. GMO confirmed on October 20 that an unauthorized program had been installed by a third party in the server environments of some customers. The company has stated it will not comply with the attackers' demands, citing the inability to guarantee deletion or prevent misuse of the information. Five Japanese FX brokers have reported that their customers were affected by the cyberattack.