Japanese internet company GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae cloud desktop service, which provides virtualized desktops to financial traders, according to a report published by TechCrunch on October 27. The IT and internet services giant said hackers appear to have published information allegedly linked to customers and its business, though the contents are still being verified. The company has advised customers to reset their passwords after receiving reports of unauthorized operations performed on customer trading accounts.
The breach may affect as many as 27,000 servers, GMO Internet said. On October 21, the company shut down its Onamae Desktop Cloud service after discovering unauthorized access had occurred to its systems without permission, and received an email from hackers demanding roughly 8 billion yen, approximately $50 million. The Japanese company reported the incident to police on October 22 and said on October 24 it would offer customers compensation and alternative service while seeking help from government agencies. Between October 25 and 26, the firm began collecting devices from customers to detect malware and better understand the damage.
The incident comes roughly a week after GMO Internet's cybersecurity unit separately reported finding evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan, according to the report. However, the company said it hasn't publicly established a connection between Artex and the breach of Onamae. The Artex tool was also used to hack financial institutions in South Korea in September, according to a report by CrowdStrike earlier this month, with attacks largely relying on exploiting weak security controls such as a lack of multi-factor authentication. Artex's Chinese developer has since stopped public updates and made the AI security tool closed-source after it was linked to cyberattacks targeting banks.
A spokesperson at Japan's Financial Service Agency told TechCrunch that it issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities. The regulator called for stronger basic defenses, including "vulnerability management, defense-in-depth and incident preparedness," while encouraging firms to use AI and other security tools. GMO Internet said on October 27 that a suspected attacker had posted information that appeared to be linked to the company and its customers, though it was still checking whether the information was genuine. The company's full extent of the incident remains unclear as verification continues. The breach underscores growing pressure on financial service providers to shore up authentication protocols and incident response capabilities as AI-powered attack tools become more accessible. Regulators may accelerate enforcement timelines if basic security gaps continue enabling large-scale compromises of trading infrastructure.