GMO Internet cloud VPS hack: stolen logins drained forex accounts; ransom threat follows
Overview
Attackers stole customer logins from GMO Internet Group's cloud VPS service, used by foreign-exchange traders, and placed trades that destroyed account balances at more than 70 brokerages, according to a report citing GMO CEO Masatoshi Kumagai.
Kumagai calls the incident a national crisis and says AI misuse has put the internet on the verge of collapse. GMO has asked government agencies for help.
A later report says GMO refused to pay a $50 million ransom. The hackers then threatened to trigger ransomware on the PCs of everyone logged into the cloud during the hack, and GMO is asking those users to unplug and turn off their PCs before a deadline.
Another report says GMO is investigating suspected unauthorized access to its Onamae Desktop Cloud service and that an attacker has posted information allegedly linked to the company and its customers. GMO says 27,000 servers may be affected and has advised customers to reset passwords. GMO has not confirmed that the posted data is genuine.
Written by AI from the articles below · updated Oct 27, 9:56 AM ET
Check the sources:
Developments
3 developments
- Oct 27, 9:32 AM ET · 1 articleGMO Internet investigates suspected breach of its Onamae cloud desktop serviceTechCrunch · AI: Japan's GMO Internet says hackers posted stolen customer data
- Oct 26, 10:30 PM ET · 1 articleGMO hackers threaten ransomware on PCs after refused $50m ransom demandAndrew Curran: GMO refuses $50M ransom, hackers threaten ransomware on logged-in PCs
- Oct 25, 11:22 AM ET · 1 articleGMO Internet CEO warns AI misuse threatens internet collapseAndrew Curran: GMO Internet CEO warns AI misuse threatens internet collapse
Article timeline
The articles in this story. Times are ET.
- TechCrunch · AINewsJapan's GMO Internet says hackers posted stolen customer data
AIGMO Internet is investigating a data leak after suspected unauthorized access to its Onamae Desktop Cloud service, and says an attacker has posted information allegedly linked to the company and its customers. The company says 27,000 servers may be affected and is advising customers to reset passwords after reports of unauthorized operations on trading accounts. GMO has not confirmed that the posted data is genuine.
Andrew Curran@AndrewCurran_XGMO refuses $50M ransom, hackers threaten ransomware on logged-in PCsAIGMO refused to pay a $50 million ransom demanded by hackers, who now threaten to trigger ransomware on PCs of everyone logged into the cloud during the hack. GMO is asking people to unplug and turn off their PCs ahead of a deadline 30 minutes away.

Andrew Curran@AndrewCurran_XGMO Internet CEO warns AI misuse threatens internet collapseAIGMO Internet Group CEO Masatoshi Kumagai says AI misuse has put the internet on the verge of collapse and calls the incident a national crisis. The warning follows a hack of GMO's cloud VPS service, used by foreign-exchange traders, in which attackers stole customer credentials and executed balance-destroying trades across more than 70 brokerages. GMO has asked government agencies for help.

Heat Trend
- Current comparable heat
- 15
- Peak comparable heat
- 27Oct 27, 10:00 AM ET
- Change in past 24 hours
- +86%
The trend compares only continuously observed participants, so its scope may be smaller than the current heat total. Hover or tap for hourly heat; use arrow keys with a keyboard.