On October 21, 2026, GMO Internet Group disclosed that a third party had put malicious programs on servers of Onamae.com Desktop Cloud, a hosting service many Japanese retail traders use to run automated FX trading. GMO says 26,739 servers were potentially affected, that trading-account logins stored on them may have been taken, and that unauthorized trades followed. CEO Masatoshi Kumagai has said publicly that the internet is starting to break down. The company's own notices and Japanese press agree on the core facts; the cause, the "70+ brokerages" figure and any AI-tool link are not confirmed.
TL;DR
| Question | Answer |
|---|---|
| What was hit? | Onamae.com Desktop Cloud, a Windows VPS service used to run MT4 and MT5 trading bots |
| Scale | 26,739 servers potentially affected (possible scope, not confirmed intrusions) |
| What was taken? | Per GMO, customer information and stored trading-account login details |
| Was money lost? | Yes. Unauthorized trades were reported; one user's loss was about 1.19 million yen |
| Ransom? | GMO says attackers made a demand and it will not meet it |
| Cause? | Not published. GMO says it found a flaw in its own systems; the CEO says internal engineers had raised security concerns |
| AI involved? | Unconfirmed |
What happened: the timeline
| Date (2026) | Event | Source |
|---|---|---|
| Oct 19 to 20 | Intrusion found or confirmed; dates vary by outlet. Malicious programs seen on some customer servers | GMO notices and press |
| Oct 21 | First report. All plans' servers stopped. Shares fall | GMO notice and press |
| Oct 22 | Second report: stored trading logins may have been obtained and misused. Customers told to change passwords and log off. Kumagai posts on X | GMO notice |
| Oct 22 to 23 | Brokers including OANDA Japan, Titan FX and AXIORY tell users to change MT4 and MT5 passwords and check trade history | Broker notices via press |
| Oct 24 | Fourth report: a system flaw and customer-information exfiltration confirmed. 5,000 yen goodwill payment, loss compensation, alternative service, and refusal of the attackers' demand. GMO asks the government to apply Japan's active cyber defense framework | GMO notice and press |
| Oct 25 | Kumagai apologizes online: internal engineers had flagged security issues, the response was insufficient and attackers "exploited a gap" | Nikkei, Yomiuri, Mainichi |
How it likely worked
GMO has not published the technical entry point, so this section is inference from what it has disclosed.
Onamae.com Desktop Cloud rents out Windows servers that stay on around the clock. Traders install MetaTrader 4 or 5 there with an expert advisor, a trading bot, and leave it running. To work unattended, the terminal holds the broker login on the server. That is the part that matters: a rented server becomes a store of working credentials for many brokerage accounts.
GMO says malware was placed on customer servers and that a flaw in its own systems let the attackers in and take customer information. If the attackers could reach many customer servers through the provider's side, they could read saved logins or the terminal's memory, sign in to broker accounts and place trades. That would explain why a single hosting provider produces losses across many brokers at once. The 70-brokerage figure fits this: it counts the firms whose accounts were exposed, not 70 separate hacks.
Claimed vs verified
| Claim | Status | Source and notes |
|---|---|---|
| Attackers placed malware on Desktop Cloud servers | Verified | GMO's notices, reported across Japanese press |
| 26,739 servers potentially affected | Verified as potential scope | GMO's figure. It is not a count of compromised servers |
| Stored trading logins were obtained and misused | Confirmed as a possibility by GMO; misuse reported | GMO second report; user losses reported by Yomiuri and others |
| Customer information was taken | Verified | GMO's fourth report |
| "Fraudulent trades across 70+ brokerages" | Partly verified | Reports say accounts at more than 70 firms were in scope or threatened. Confirmed trades are a smaller set; we found no total |
| Attackers made an extortion demand, refused | Reported | GMO says it will not meet the demand; the demand's wording is not public |
| Internal staff had warned about the weakness | Reported | Kumagai's own apology, as reported by Nikkei, Yomiuri and Mainichi |
| CEO says the internet "is breaking down" | Reported | Quoted through social posts and outlets such as OfficeChai. We did not see the original text |
| An AI penetration tool such as ARTEX was used | Unverified | Appears in some outlets and posts. Not in GMO's notices that we found |
| The Financial Services Agency asked FX firms to watch for suspicious trades | Reported, mixed | Cited by Nikkei per one summary; another search found no confirmation |
| Shares fell | Verified, size varies | Intraday drops of roughly 9 percent to 11 percent depending on the report and time |
Is the internet about to collapse?
The CEO's line travels well, and it is hard to test. What the facts support is narrower. A provider that holds credentials for thousands of customers is a high-value target, and the attackers needed no new exploit in a broker to profit from it. If, as GMO's CEO says, his own engineers had flagged weaknesses, the lesson is about patching speed and where secrets live, not about the network failing. The AI link would change the tempo of such attacks, which our posts on ARTEX against South Korean banks and Storm-0940's ARTEX agents examine, but nobody has shown it here.
What to do if you run a trading VPS
- Change passwords from a clean device. Reset broker and MT4 or MT5 passwords, and the investor password, from a computer you trust, not from the server.
- Log out everywhere. End all sessions on the broker side, then on the server.
- Check your account. Review trade history, open positions, withdrawals and any new linked devices or API keys. Report anything odd to your broker.
- Turn on two-factor sign-in at the broker and for the hosting account.
- Do not rely on saved passwords on a hosted server. If you must run a bot, use an investor-only or restricted login where your broker allows it, and keep withdrawal rights separate.
- Rebuild, don't clean. Treat a server from this service as compromised. Move to a fresh server or provider rather than trusting an in-place fix.
- Keep records for compensation. GMO says claim guidance was due by November 6. Save dates, trades and loss amounts.
For anyone running production services, the generic playbook applies: see what to do after an attack on your app and rotating secrets after a provider breach.
What this means if you run AI coding agents
Many traders now write expert advisors and deployment scripts with coding agents. An agent that can read your shell can also read a terminal's config files and saved logins. Keep broker credentials out of the agent's working directory, use restricted keys for anything it runs, and review what it executed.
How Beam handles this
Beam does not scan hosting providers or protect a VPS, and it cannot stop a provider-side breach like this one. It watches the coding agents on your own machine: it records the commands and tool calls they run, flags credential access and risky commands, and can deny some of them through Claude Code and Codex hooks under workspace policy, all on-device. That helps keep a trading bot's keys from leaking through your agent, and it will not rescue a server you rent. Enforcement is hook-based, not a kernel sandbox, and scanning is heuristic.
What we will watch for
- GMO's technical root cause and whether the intrusion path is published.
- A total of confirmed unauthorized trades and affected brokers.
- Evidence for or against an AI tool in the attack.
- Whether the government applies active cyber defense, and any action from the Financial Services Agency.
We will update this post and the October 2026 attacks timeline as GMO publishes more.
Frequently asked questions
What was breached? Onamae.com Desktop Cloud, GMO Internet's hosted Windows servers used for automated FX trading.
How big is it? 26,739 servers potentially affected. Confirmed losses are smaller and not totalled publicly.
Did GMO pay the attackers? GMO says it will not meet the demand.
Will customers be compensated? GMO says yes: 5,000 yen each, plus recognized realized losses.
Was AI behind it? Unverified.
Related reading
- ARTEX against South Korean banks
- Storm-0940 and ARTEX agents
- October 2026 attacks timeline
- What to do after an attack on your app
- Railway breach: rotate every secret
- AI-led attacks in October 2026
Sources: GMO Internet: notice and apology on unauthorized access to Onamae.com Desktop Cloud (second report) · INTERNET Watch · Impress Watch · NHK · Nikkei on the active cyber defense request · piyolog timeline · ASCII.jp · OfficeChai
Details are accurate as of October 26, 2026. We could not open most sources directly and relied on search summaries of them, so check GMO's notices for the latest numbers.