GMO Internet has rejected a $50 million ransom demand from hackers who broke into its Onamae.com Desktop Cloud service, Group CEO Masatoshi Kumagai wrote on Oct. 26. In a blog post first published on Oct. 25 and updated a day later, the executive confirmed that none of the attacker demands were met and nothing was paid.

As many as 26,739 servers may be affected by the breach, and some customers reported seeing unauthorized trades placed through their brokerage accounts.

Up to 26,739 Onamae.com servers may be affected

Onamae.com Desktop Cloud runs brokerage software such as MetaTrader 4 and MetaTrader 5 on customer servers. According to GMO, an attacker exploited a security flaw, planted malware in some customer environments and stole customer data.

The issue first surfaced on October 19, when a customer raised a question. Malware was detected the following day, and GMO began shutting down all plans from 19:00 UTC on October 20.

The company stressed that the 26,739 figure is a count of potentially impacted servers, not verified breaches. Some customers reported trades placed without permission through tools running on the service. That detail explains the reach of the incident: because GMO hosted the trading tools, a compromise at the provider level could surface directly in customers' brokerage accounts.

In-house white-hat hackers had flagged security issues with the service in advance. Kumagai acknowledged that the company's response was lacking in depth and speed, and the attacker passed through the gap.

GMO Internet Group shares shed almost 16% on Monday, falling to a four-month low. The company said it could not yet quantify the impact on earnings of the goodwill payments and compensation for losses.

Attacker threatened accounts at over 70 securities and FX firms

The blog post lists what the attacker threatened. The list begins with further fraudulent orders on customer accounts at more than 70 securities and foreign-exchange firms in Japan and abroad. The attacker also threatened to leak data from connected customer PCs, deploy ransomware and publish internal details of GMO's systems. Those were threats, not confirmed activity at all 70-plus firms.

A ransom document stamped 11:57 on October 21 demanded $50 million, about 8 billion yen. The note asked for payment in Bitcoin or Ether by 5 p.m. Japan time that day and said GMO's crypto exchange subsidiary could pay immediately.

GMO stated that paying would not guarantee the stolen data would not be misused. The company is working with police and other authorities on the matter.

Kumagai dismissed criticism that a flat 5,000 yen goodwill payment to all customers was an attempt to close the issue. It was the first step, he said.

GMO Internet will verify and compensate for fraudulent trade losses related to the breach. If an exchange refuses a refund, it pays the full amount of eligible losses itself.

The group also pledged a six-month free replacement environment, a reconstruction of its system base and an outside review of the root cause. GMO Cyber Security by Ierae and GMO Flatt Security are involved in defense and log analysis with approximately 200 security staff, including former Interpol personnel. GMO has also begun court disclosure requests to track down the attackers.

'AI cyber saturation attack'

Kumagai called the attack a symbol of an "AI cyber saturation attack," in which inexpensive AI tools enable attackers to overpower defenders. GMO Cyber Security by Ierae found that ARTEX, an autonomous AI penetration-testing tool built for defense, was misused in attacks on some 20 Japanese companies.

He also mentioned the recent PHP flaws, where automated attack attempts ran to millions in hours. According to Cryptopolitan, the two PHP2Shell bugs have a severity score of 9.2 out of 10, and PHP shipped fixes on October 21. GMO has not connected its own breach to the PHP flaws.

On Oct. 24, Kumagai asked Tokyo to apply Japan's law on active cyber defense, which went into effect Oct. 1. GMO is not a designated critical-infrastructure operator under the law, and he acknowledged that the decision lies with the government.

Prime Minister Sanae Takaichi said Monday evening that the government plans an emergency package of cybersecurity safeguards by sometime next week.

For readers tracking the fallout, the open questions are the ones GMO and the government have already placed on the record: which of the 26,739 potentially affected servers are confirmed as compromised, what the outside root-cause review finds, how fraudulent-trade compensation is settled, and what the emergency cybersecurity package expected by next week contains.