GMO Internet Group confirmed on October 20, 2026 that a malicious program had been installed inside some Onamae.com Desktop Cloud customer server environments, exposing up to 26,739 servers to potential unauthorized access and placing trading-account credentials at direct risk of.

The incident reaches one of Japan's largest internet infrastructure conglomerates at a particularly sensitive layer: cloud-hosted desktop environments used by retail foreign exchange (FX) and cryptocurrency traders to run automated strategies on MetaTrader 4 and MetaTrader 5. When attackers compromise the host environment rather than the trading application itself, credential theft bypasses whatever application-layer protections the user has configured.

What GMO Has Confirmed

According to GMO's official disclosure, the company identified a third-party malicious program installed within Onamae.com Desktop Cloud server environments. GMO confirmed that customers subsequently reported unauthorized operations on their trading accounts, and that trading-account login credentials stored on those servers may have been viewed by the attacker.

The company reported 26,739 potentially affected servers across the service. That figure represents the potential exposure scope — not a confirmed count of servers with verified unauthorized access or confirmed data acquisition.

GMO began suspending all Onamae.com Desktop Cloud plan servers at 4:00 JST on October 21, 2026, describing the shutdown as a preventive measure to contain further damage. The full-service suspension means every customer running automated trading bots or active MetaTrader sessions on the platform lost access simultaneously.

In a third update published on October 23 (GMO's alert notice), the company stated that it consulted police on October 22, engaged an external security specialist, and initiated reports and consultations with relevant regulatory authorities. The intrusion method, the attacker's identity, and the confirmed number of compromised servers remain undisclosed in the official filings reviewed.

Why the Trading-Account Credential Risk Is Distinct

Onamae.com Desktop Cloud is a virtual desktop infrastructure product. Traders use it to keep MetaTrader instances running continuously without tying up local hardware. That architecture means credentials for brokerage accounts, FX platforms, and crypto exchanges are routinely stored in browser sessions, application configurations, and clipboard history on the hosted server — not just in the trader's local environment.

An attacker with execution access to those server environments could harvest stored credentials passively, without triggering any alerts at the broker level. GMO's disclosure that customers reported unauthorized trading-account operations suggests credential extraction was not merely theoretical in at least some cases.

GMO's containment guidance emphasized a nuance that distinguishes this incident from a standard password-reset scenario: changing a broker password does not immediately terminate an existing authenticated session. Customers were advised to explicitly log out all active sessions through their broker's interface in addition to changing credentials, because an attacker holding a valid session token can continue operating even after the password is rotated. This session-persistence risk is the most operationally critical detail for affected users, and it is absent from much secondary coverage of the incident.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) offers directly relevant guidance. CISA states that multi-factor authentication adds a second identity check such that "even if an unauthorized user steals your password, they won't be able to meet the second step requirement to access your accounts," according to the agency's MFA guidance page. For traders whose credentials were stored on affected servers without MFA configured at the broker level, a credential change alone provides limited assurance.

Scope: Potential Exposure Versus Confirmed Compromise

The 26,739-server figure warrants careful framing. GMO's October 23 report explicitly clarified that it is a potential-exposure count, meaning servers that were active within the affected service environment during the window of compromise — not servers where unauthorized access or data acquisition has been individually confirmed. The distinction matters for assessing the actual blast radius as the investigation progresses.

No official disclosure reviewed to date identifies the number of FX brokerages whose customers were affected, the total number of trading accounts at risk, confirmed monetary losses, or a service restoration timeline. One crypto-media report cited extortion demands and impacts across more than 70 brokerages, but those claims do not appear in GMO's own filings and should be treated as unverified until confirmed by the company or law enforcement.

The incident has structural parallels to supply-chain intrusions targeting shared infrastructure. When a single cloud desktop provider serves thousands of trading clients, a single malicious implant can achieve horizontal credential exposure across a broad set of brokerages and exchanges simultaneously, multiplying the effective attack surface well beyond what direct brokerage intrusions would reach. The Electrum malicious-server attack vector demonstrated a similar multiplier dynamic, in which infrastructure-layer compromise produced credential and fund losses across a distributed user base.

What to Watch as the Investigation Continues

GMO has not provided a restoration timeline for Onamae.com Desktop Cloud services. Customers with active MetaTrader strategies or open FX positions on the platform remain locked out following the October 21 suspension. The external security specialist engagement and police consultation suggest a formal forensic process is underway, but the company has not indicated when findings will be published.

Three disclosure gaps are worth tracking in subsequent GMO updates: first, whether the malicious program was a targeted implant or opportunistic malware; second, the confirmed vector of initial access; and third, whether any specific brokerages or custodians have been individually notified of confirmed credential exposure affecting their customer accounts.

For traders who had active sessions on the platform, the immediate risk surface extends beyond FX accounts. Virtual desktop environments used for trading frequently store API keys for cryptocurrency exchange connections, wallet software configurations, and browser-saved credentials for on-chain portfolio tools. With Bitcoin testing the $80,000 level amid elevated market volatility, any delay in session termination and credential rotation across connected crypto accounts compounds the exposure window. The Fear and Greed Index stood at a neutral 50, but open trading positions on breached infrastructure carry protocol-level risk independent of market direction.

Until GMO publishes confirmed compromise counts and resumes service, affected users should treat all credentials stored on Onamae.com Desktop Cloud servers as compromised, terminate broker and exchange sessions independently of any password reset, and enable MFA on every account the server environment had access to.