GMO Internet Faces Scrutiny and Market Plunge Following Cyberattack in Japan

Tokyo-based tech conglomerate GMO Internet Group is facing intense public scrutiny and sharp market losses following an extortion cyberattack targeting its foreign exchange cloud trading platform. The breach resulted in leaked customer data, a severed extortion website, and mounting criticism regarding how an IT company claiming world-class cybersecurity defenses failed to act swiftly on known system vulnerabilities.

The breach came to light after malicious software was detected on October 20, 2026, within GMO's Onamae.com Desktop Cloud service, which supports more than 20,000 foreign exchange margin traders. The attackers initially demanded a ransom of roughly 8 billion yen before slashing their demand to around 160 million yen. GMO adamantly refused to pay, stating it would never yield to criminal demands. On October 27, the extortionists published the detailed personal and financial credentials of one user online and threatened daily releases. However, new leaks halted on October 28 after the domain hosting the attackers' site was suspended.

Cybersecurity experts have observed striking oddities in the assault, suggesting the culprit is not an organized syndicate. Takayuki Sugiura, representative director of the Japan Hacker Association, stated that the perpetrator is likely an amateur relying on artificial intelligence tools. Sugiura highlighted the steep ransom reduction, overly courteous extortion messages, and an AI-constructed site hosted on the open web rather than darknet forums. Nobuo Miwa, president of cybersecurity firm S&J, concurred that the theatrics and publication of GMO's technical vulnerabilities pointed to a desire for personal recognition rather than standard, efficient extortion.

The breach has dealt a serious blow to GMO's reputation as a cybersecurity leader. Despite employing more than 200 in-house white-hat hackers and asserting global-standard defenses following its 2022 acquisition of Ierae Security, corporate management acknowledged internal shortcomings. GMO Chairman and CEO Masatoshi Kumagaya admitted that internal ethical hackers had previously identified flaws in the system, but the company's remedial response lacked adequate depth and speed due to operational priorities.

That delayed action has sparked sharp public pushback. Appearing on a national news program, University of Tokyo Associate Professor Kohei Saito argued that GMO cannot simply present itself as a victim after neglecting predictable system flaws. Saito also questioned GMO's urgent petition asking the Japanese government to enact active cyber defense measures, which would empower defense and police forces to neutralize hostile infrastructure. Saito warned that deploying state power to intervene in private data networks could erode civil liberties and looks like an attempt by a private corporation to shift responsibility.

The crisis poses significant business risks for GMO, which expanded over two decades from a modest 1990s venture into an empire of more than 150 subsidiaries and 8,000 employees, reporting 285.6 billion yen in consolidated net sales for 2025. Following the leak on October 27, GMO's share price dropped over 4 percent in intraday trading, bringing its total decline since the disclosure on October 21 to more than 20 percent. The incident closely follows an October 5 intrusion at subsidiary GMO Research & AI, which exposed details from roughly 950,000 accounts. In response to the FX cloud breach, GMO announced a flat 5,000-yen solatium payment per customer alongside full reimbursement for unauthorized trading losses.

Law enforcement and government officials are now actively intervening. Tokyo's Metropolitan Police Department has questioned GMO representatives as well as the victim whose identity was exposed online. Chief Cabinet Secretary Minoru Kihara affirmed that government ministries are liaising closely with the company to ensure rapid countermeasures. Security analysts advise users not to access unverified sites or links claiming to showcase the leaked customer records, warning that secondary phishing attempts and malware threats remain high.