GMO Internet Group Server Breach: Hackers Destroy Traders' Funds

Japanese internet holding company GMO Internet Group fell victim to a large-scale cyberattack, resulting in attackers gaining access to the servers of the cloud service Onamae Desktop Cloud. The incident affected traders using rented machines for automated Forex trading.

Criminals used stolen broker account credentials to destroy client funds by opening losing trades rather than direct withdrawals. One victim lost 4.16 million yen (about $27,000) in just two seconds, while another lost nearly 3 million yen in four seconds.

Up to 26,739 servers were potentially at risk, although the exact number of compromised machines remains unconfirmed. The company has disconnected the Onamae Desktop Cloud service and officially acknowledged the data breach.

• Hackers demanded a ransom under threat of continuing to destroy client funds across more than 70 brokers.
• Threats included leaking user personal data and infecting computers with ransomware viruses.
• The estimated damage, claimed by the hackers themselves, is 6.6 billion yen (approximately $43 million), though this figure lacks independent confirmation.

GMO Internet Group management refused to pay the ransom and contacted the police. The company promised to compensate clients only for losses confirmed through official investigations.

Group head Masatoshi Kumagai admitted that internal security specialists had previously warned about vulnerabilities, but remediation measures were implemented too slowly. In his view, the rapid rise in AI-driven attacks is beginning to destabilize the internet as a whole.