Japan internet giant GMO says hackers posted stolen customer data

2026-10-27 21:32 TechCrunch AI Kate Park 约 11 分钟读完

Japan's GMO Internet is verifying alleged customer data posted by suspected hackers following a cloud service breach.

Kate Park

6:32 AM PDT · October 27, 2026

Japanese internet company GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae cloud desktop service, which provides virtualized desktops to financial traders.

The IT and internet services giant said on its blog that it believes the attacker has published information allegedly linked to customers and its business. However, the contents are still being verified and the full extent of the incident remains unclear.

GMO Internet has since advised customers to reset their passwords, amid receiving reports of “unauthorized operations” performed on customer trading accounts. The company said 27,000 servers may be affected by the breach.

A spokesperson for GMO Internet did not respond to TechCrunch’s request for comment.

The incident comes about a week after the Japanese firm’s cybersecurity unit separately reported finding evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan. However, the company said it has not publicly established a connection between Artex and the breach of Onamae.

The Artex tool was also used to hack financial institutions in South Korea in September, according to a report by CrowdStrike earlier this month. The attacks largely relied on exploiting weak security controls , such as a lack of multi-factor authentication. Artex’s Chinese developer has since stopped public updates and made the AI security tool closed-source after it was linked to cyberattacks targeting banks, per Reuters .

A spokesperson at Japan’s Financial Service Agency (FSA) told TechCrunch that it issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities.

The regulator called for stronger basic defenses, including “vulnerability management, defense-in-depth and incident preparedness,” while encouraging firms to use AI and other security tools, the spokesperson added.

Here’s the timeline of the Onamae breach.

October 21: GMO Internet shut down its Onamae Desktop Cloud service after discovering unauthorized access had occurred to its systems without permission. The IT firm also received an email from hackers demanding about 8 billion yen (~$50 million).

October 22: The Japanese company reported the incident to Japanese police and shared another public update .

October 24: GMO Internet said it would offer customers compensation and alternative service while seeking help from government agencies.

October 25-26: The company began collecting devices from customers to detect malware and better understand the damage.

October 27: The Japanese IT firm said a suspected attacker had posted information that appeared to be linked to the company and its customers. GMO said it was still checking whether the information was genuine.

Topics

AI , CrowdStrike , cybersecurity , GMO Internet , Japan , Japan , Security , security , south korea , South Korea

When you purchase through links in our articles, we may earn a small commission . This doesn’t affect our editorial independence.

Kate Park

Reporter, Asia

Kate Park is a reporter at TechCrunch, with a focus on technology, startups and venture capital in Asia. She previously was a financial journalist at Mergermarket covering M&A, private equity and venture capital.

View Bio

November 4

Boston

Buy One Pass, Get a Second Free

Cover more ground at TechCrunch’s ultimate founder bootcamp of the year by bringing your co-founder or partner for free

Book before the BOGO deal expires