Japanese internet giant GMO Internet is currently investigating a data leak following suspected unauthorized access to its Onamae cloud desktop service. This service, which provides virtualized desktops to financial traders, has been compromised.
The IT and internet services leader stated in a blog post that it believes the attacker has published information allegedly connected to customers and the company's operations. However, the company is still verifying the authenticity of this data, and the full scope of the incident remains undetermined.
In response to the breach, GMO Internet has instructed customers to reset their passwords, particularly as reports surface regarding "unauthorized operations" on trading accounts. The company estimates that approximately 27,000 servers may be impacted by the security failure.
TechCrunch reports that a spokesperson for GMO Internet declined to comment on the matter.
This incident occurs roughly a week after the Japanese firm’s cybersecurity unit independently disclosed evidence that a Chinese AI-enabled penetration testing tool named Artex was utilized in attacks targeting various Japanese companies. Despite this, GMO has not publicly confirmed a direct link between Artex and the specific Onamae breach.
According to a CrowdStrike report released earlier this month, the Artex tool was also employed to compromise financial institutions in South Korea in September. These attacks primarily relied on exploiting weak security controls, such as a lack of multi-factor authentication. Following these cyberattacks against banks, the Chinese developer of Artex reportedly ceased public updates and switched the AI security tool to a closed-source model, as reported by Reuters.
A spokesperson for Japan’s Financial Service Agency (FSA) informed TechCrunch that the agency issued guidance in May. This guidance urged financial institutions to prepare for an increase in cybersecurity vulnerabilities, calling for stronger basic defenses like "vulnerability management, defense-in-depth and incident preparedness," while also encouraging the adoption of AI and other security tools.
A timeline of the Onamae breach details the following events: Oct 21: GMO Internet shut down Onamae Desktop Cloud service after discovering unauthorized access had occurred without permission. The IT firm also received an email from hackers demanding approximately 8 billion yen (~$50 million). Oct 22: The company reported the incident to Japanese police and shared another public update. Oct 24: GMO Internet announced plans to offer customers compensation and alternative services while seeking assistance from government agencies. Oct 25-26: The company began collecting devices from customers to detect malware and assess the damage. Oct 27: The Japanese IT firm announced that a suspected attacker had posted information appearing linked to the company and its customers, noting that verification of the data's authenticity was ongoing.
The Editorial Staff at AIChief is a team of professional content writers with extensive experience in AI and marketing. Founded in 2025, AIChief has quickly grown into the largest free AI resource hub in the industry.