GMO Internet Group urgently requested that the government apply active cyber defense. The request concerns cloud servers used for automated FX trading. The company disclosed unauthorized transactions involving users’ cash and the leakage of information, and explained the payment of compensation and condolence payments.
On 24 October 2026, GMO Internet Group confirmed unauthorized access to Onamae.com Desktop Cloud, which provides servers for automated FX trading, and suspended the servers starting on the 21st. The timing of their resumption is undecided, and users have reported losing cash through transactions they do not recognize.
On the 24th, GMO acknowledged that customer information had been removed externally and announced that it would compensate users for part of their losses, regardless of whether they had suffered damage. In addition, it will pay ¥5,000 to all users as a condolence payment and provide an alternative service free of charge for 6 months to those who request it. The company also outlined its policy for responding to monetary demands from individuals believed to be the attackers.
Active cyber defense is a framework under which the police and Self-Defense Forces identify and attempt to neutralize attackers’ servers and routes during serious cyberattacks. Full-scale operations began on 1 October 2026. The framework covers critical infrastructure operators in 15 fields, including power and finance. GMO is not included among the covered operators, but the government is considering its response based on the seriousness and urgency of the incident.
The government has no mechanism for accepting individual requests from companies, and it will make the decision on whether to carry out neutralization measures on its own initiative. However, defensive assistance is expected to be provided. The government has explained that it will share attack indicators and communications records provided by GMO with the police and work to identify the servers from which the attacks originated.