The Day Financial Infrastructure Stops: A Japanese VPS Breach, Search Suggestions, Share Prices, and What Under-investing in Security Costs (Flash Edition)

SHARE

日本語版: 金融インフラが止まる日 ― 不正アクセス事案のサジェスト推移・株価と、セキュリティ投資の一般論（速報版）

A VPS service used to run automated FX trading went offline, and its users were asked to back up their data, unplug their PCs and power them off. On the first trading day after the operator confirmed that customer data had been taken (Notice No. 4, 24 October), the parent company’s share price fell by more than 15%. This article records the sequence of events from public sources only, follows how search suggestions and share prices moved, and, separately from the still-unpublished cause of this incident, sets out what under-investing in security can cost any operator. This is a flash edition; the figures will be updated every business day (see the update history at the end). Press reports say that after the 27 October deadline the attacker published one item of what appears to be personal data and announced daily publications at noon (authenticity unknown; see section 1).

1. What happened (public information as of 13:00 JST, 27 October 2026)

The service is “Onamae.com Desktop Cloud”, a Windows VPS offered by GMO Internet, Inc. for running MT4/MT5 expert advisors (automated FX trading) around the clock. Up to 26,739 servers may be affected. The timeline below is limited to what the company has published and what has been reported. The cause (the intrusion route) has not been officially disclosed as of 27 October.

Date Fact Source (checked 2026-10-27)
19 Oct Investigation started after customer inquiries GMO Notice No. 2 (22 Oct): https://group.gmo/info/alert/20261022/
20 Oct Unauthorized programs found on some customer servers. New sign-ups and the control panel suspended Same; Notice No. 1 (21 Oct): https://www.onamae.com/news/article/11584
21 Oct, 04:00 Servers for all plans shut down in sequence to contain the damage (still offline). Notice No. 1 published Same
22 Oct Notice No. 2: login credentials for trading tools stored on servers may have been obtained and misused by a third party. Police consulted GMO Notice No. 2
24 Oct Notice No. 4: customer data confirmed taken outside the company. The company says it has received a ransom demand and threats to publish data, continue unauthorized orders at more than 70 securities and FX firms, and run ransomware (the content of the threats is unverified); it will not pay. Announces a flat 5,000-yen payment to every customer, compensation for realized losses from unauthorized trades, and six months of a replacement environment free of charge. Asks the government to apply “active cyber defense” measures GMO Notice No. 4: https://group.gmo/info/alert/20261024/; Impress Watch: https://internet.watch.impress.co.jp/docs/news/2150991.html
25 Oct CEO Masatoshi Kumagai publishes a blog post: internal white-hat hackers had flagged improvement items in advance; the depth and speed of the response were insufficient; the operations team had weighed availability and other priorities. States that the company has not accepted, and has not paid, a demand of about 8 billion yen (USD 50 million) Kumagai’s blog: https://www.kumagai.com/?eid=19600; GMO notice: https://group.gmo/info/alert/20261025/; ASCII: https://ascii.jp/elem/000/004/445/4445544/; ITmedia: https://www.itmedia.co.jp/news/article/2610/26/2000002571/
26 Oct On the Tokyo Stock Exchange, GMO Internet Group (9449) closes at 3,179 yen, down 590 yen (about 16%) from the previous Friday. GMO Internet (4784) closes at 418 yen, down 73 yen Nikkei: https://www.nikkei.com/article/DGXZQOUB267FQ0W6A021C2000000/; Reuters: https://news.infoseek.co.jp/article/26reutersJAPAN_KCN3W50XR/
26 Oct A party claiming to be the attacker announces it will publish customer data and launch ransomware against customer PCs at noon on 27 October (the amount demanded on the attacker’s site is reported as about USD 1 million). GMO asks users to back up their data before the deadline, unplug their PCs and power them off. Employees visit customers’ homes to collect devices, which the company’s white-hat team is analysing Impress Watch (27 Oct): https://www.watch.impress.co.jp/docs/news/2151375.html; ITmedia (27 Oct): https://www.itmedia.co.jp/news/article/2610/27/2000002610/; NHK (27 Oct): https://news.web.nhk/newsweb/na/nd-20261027de66048
27 Oct, 12:00 The attacker’s stated deadline. GMO maintains that it will not pay NHK (updated 12:20, 27 Oct)
27 Oct, afternoon Press reports that the attacker, saying GMO had not negotiated by the deadline, published on a Japanese-language site one item of what appears to be personal data (including a name and phone number). Its authenticity is unknown. In a new statement the attacker says it will continue to publish personal data every day at noon, and will stop if its demands are accepted. Asked about the authenticity of the statement, GMO Internet Group said it would refrain from commenting on individual matters Yomiuri Shimbun Online (27 Oct, 13:15): https://news.yahoo.co.jp/articles/1ee8419ae44aad58464adb11d4a0ca32b9a9c059; Kyodo (27 Oct, 13:17): https://news.yahoo.co.jp/articles/21ce54e7458ee2f0d2bb701e6719b7e688573a1c
By 30 Oct Details of the 5,000-yen payment to be sent to registered email addresses (planned) GMO Notice No. 4
By 6 Nov Details of the loss-compensation application to be announced (planned) GMO Notice No. 4

Notes:

  • The amount demanded is reported differently: USD 50 million (about 8 billion yen) according to Kumagai’s blog and the company, and USD 1 million (about 160 million yen) in the deadline notice on the attacker’s site. The initial demand and a later deadline demand may differ. This article lists both with their sources and goes no further.
  • Claims about the intrusion route or internal configuration contained in the statement of the party claiming to be the attacker are not covered here, because they are not published facts. The name of the attacker group is not given either, as it has not been confirmed by multiple outlets.
  • The Minister for Financial Services has said that five FX firms reported customer losses believed to be related to this case (press reports). The firms and the individual users are not identified in this article.

2. Why this is existential for users

Automated FX trading keeps open positions around the clock. If the VPS stops, users can neither close positions nor adjust them, and any market move turns into a realized loss. That is the first thing users faced in this incident. The company explains the shutdown as a measure to contain the damage, but at that moment users are left unable to trade.

Next came the request to back up data, unplug the PC and power it off. For many people the PC connected to the service is also a tool for work and daily life. Being asked to switch it off means stopping part of one’s business or life, not just trading. Reports also describe employees visiting customers’ homes to take custody of devices. For the user, that means the PC leaves their hands.

The announced payment and compensation matter, but Notice No. 4 limits compensation to realized losses from unauthorized trades (trading losses and fees); losses from market moves and lost profits are excluded. The opportunity cost of positions that could not be managed, and the business downtime while the PC is off, fall outside that scope.

This is not specific to this case. In general, part of the cost of a breach is paid by users, in time and lost opportunity. Where prior investment fell short, users end up paying the difference.

3. Search suggestions

Search suggestions reflect what people are worried enough to search for. Using Egosaru (gstudio1.com), I am collecting the phrases that follow each GMO group brand name twice a day from 27 October. The question is which words (“unauthorized access”, “data leak”, “compensation”, “cancel”, “is it safe”) attach to which brand names, and in what order.

1. Figure 1. Incident-related suggestion counts, Google Trends, and relative share prices of 9449 and 7177 (23 Oct = 100)

Figure 1. Incident-related suggestion counts, Google Trends, and relative share prices of 9449 and 7177 (23 Oct = 100)

As of this flash edition there is only the first collection run, 12:17–12:40 JST on 27 October (the baseline). In that run of Google suggestions (Japanese), incident-specific words were attached to the following brands:

  • “GMO Internet Group”: “unauthorized access”, “data leak”, “share price fall reason”
  • “GMO Internet”: “unauthorized access”, “leak”, “share price fall”
  • “Onamae.com”: “ransomware”, “dangerous”, “is it safe”
  • “GMO Click Securities”: “unauthorized access”, “full compensation”, “is it safe”
  • “GMO Payment Gateway” and “GMO GlobalSign”: “leak”, “share price fall reason”
  • “ConoHa”: “unauthorized access”

The name of the affected service itself (“Onamae.com Desktop Cloud”) had only 28 candidates and no incident-specific words. Meanwhile, group services not directly involved, such as GMO Click Securities, GMO Payment Gateway, GMO GlobalSign and ConoHa, carried “unauthorized access”, “leak” or “share price fall”. Whether those words were already attached before the incident cannot be judged from this baseline alone: for “GMO Coin” and “GMO Aozora Net Bank”, collected ahead of time on 24–25 October, “unauthorized access”, “data leak” and “dangerous” were already attached before the disclosure and were unchanged on 27 October. An “unauthorized access” suggestion therefore does not, by itself, mean an effect of this incident. Because the incident-word count (top panel of Figure 1) also includes everyday words such as “login” and “cancel”, read it as a change from the baseline, not as an absolute level. Two things are being watched:

  1. The incident concerns a single service, “Onamae.com Desktop Cloud”. Do anxiety words spread to “Onamae.com” as a whole, and then to the group name “GMO”?
  2. Do “is it safe” and “cancel” attach to unrelated group services (hosting, domains, payments, securities)? If so, anxiety words have spread beyond the scope of the incident to other services in the group (this is an indicator of attention, not an evaluation).

In the Google Trends panel of Figure 1 (Japan; relative values with the 90-day maximum set to 100), search interest in “GMO Internet” rose after the 24 October disclosure and peaked on 26–27 October; “Onamae.com” rose from 26 October. Lolipop shows a separate peak on 22 October, before the disclosure; no relation to this incident can be confirmed.

Suggestions indicate attention, not facts. A “cancel” suggestion does not mean cancellations increased. This caveat will be repeated every time the chart is updated.

4. Share prices

Stock Close on 23 Oct (last trading day before Notice No. 4) Close on 26 Oct (first trading day after Notice No. 4) Close on 27 Oct Change vs 23 Oct Volume (26 Oct → 27 Oct)
9449 GMO Internet Group 3,769 yen 3,179 yen (−15.7%) 3,159 yen −610 yen (−16.2%) 3.86M → 5.92M shares (3.2× → 4.9× the 23 Oct volume)
7177 GMO Financial Holdings 1,128 yen 1,045 yen (−7.4%) 1,046 yen −82 yen (−7.3%) 2.25M → 0.92M shares
4784 GMO Internet 491 yen 418 yen (−14.9%) 409 yen −82 yen (−16.7%) 8.47M → 7.25M shares

Sources: Yahoo! Finance Japan (daily data for each stock, checked after the close on 2026-10-27). On 27 October, 9449 recovered in the morning, fell to a low of 3,040 yen in the afternoon and closed at 3,159 yen (−0.63% on the day). The Nikkei 225 rose over the same period from 23 October.

2. Figure 3. Change in market capitalization of listed group companies vs 23 Oct

Figure 3. Change in market capitalization of listed group companies vs 23 Oct

On the 27 October close, the market capitalization of 9449 was down about 56.7 billion yen (16.2%) from 23 October, 7177 about 9.7 billion yen (7.3%), 4784 (GMO Internet) about 25.0 billion yen (16.7%) and 3769 (GMO Payment Gateway) about 31.1 billion yen (4.7%) (shares outstanding from Yahoo Finance; treasury shares not taken into account). The simple total for eight listed group companies (9449, 7177, 3769, 3633, 3788, 4051, 6180, 4784) is about 126.1 billion yen (9.0%) down, or about 101.1 billion yen (8.1%) excluding 4784. Market capitalizations of the parent (9449) and listed subsidiaries (such as 4784) overlap, so the total is not adjusted for ownership. Figure 3 uses the same close-based values (3695 is excluded because its company name could not be confirmed).

That the parent company’s share price fell 15.7% from 23 October on the first trading day after Notice No. 4, and closed 16.2% below that level again on 27 October, is a matter of public record. The figure includes the movement of the market as a whole and does not isolate the effect of the incident. Selling also reached the holding company of the group’s FX businesses (7177); the reason cannot be confirmed from public information.

A rough calculation of the flat payment from public figures only: 5,000 yen multiplied by the 26,739 potentially affected servers, as an upper bound, is about 134 million yen. The value lost in the share price decline is of a different order. The point is not that the compensation is small. In general, the cost of a breach can show up far more in lost enterprise value than in the compensation paid.

This article is not investment advice. Share prices are treated as a record of what happened; no trading recommendation or forecast is made.

5. In general: what happens when security investment is deferred

The rest of this section leaves the present case and sets out what past cases and existing rules say in general. The cause of the present case has not been disclosed, and nothing below is applied to it.

3. Figure 4. General pattern: how deferred security investment can cascade (not a description of any specific incident)

Figure 4. General pattern: how deferred security investment can cascade (not a description of any specific incident)

5-1. A change in trust shows up in search behaviour within days

In past incidents, anxiety words attached to brand searches within days of disclosure, changing the character of searches for the brand. For this case, section 3 will track the data and this article will be updated when it is available.

5-2. The size of what comes after

  • Benesse (Japan, 2014): After a leak of customer data, the company booked an extraordinary loss of 26 billion yen (20 billion yen for compensation and 6 billion yen for investigation and countermeasures) and posted a net loss for April–June 2014. The vice chairman and the CIO resigned (source: ScanNetSecurity, 2014-08-01, https://scan.netsecurity.ne.jp/article/2014/08/01/34611.html; and 2015-02-10).
  • Equifax (US, 2017): Data on about 147 million people was exposed. In 2019 the company agreed to a global settlement with the FTC, the CFPB and 50 states and territories of at least USD 575 million and up to USD 700 million (source: FTC press release, 2019-07-22, https://www.ftc.gov/news-events/news/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related-2017-data-breach).
  • Colonial Pipeline (US, 2021): Ransomware halted the fuel pipeline serving the US East Coast. The CEO testified before the Senate that the company had paid a ransom worth about USD 4.4 million (source: AP, 2021-06-08, https://www.bangordailynews.com/2021/06/08/nation/pipeline-ceo-defends-paying-ransom-amid-cyberattack/).

The amounts incurred after the fact are as above. A comparison with the cost of prior countermeasures cannot be made from public information, but the size of the after-the-fact amounts is common to all three.

5-3. Shareholder litigation and directors’ responsibility

In Japan, directors owe a duty of care under Article 423 of the Companies Act, and the Ministry of Economy, Trade and Industry’s Cybersecurity Management Guidelines call for the board to oversee cybersecurity as a management issue. The Financial Services Agency’s supervisory guidelines likewise treat system-risk management as a responsibility of senior management. In the US, the SEC introduced disclosure rules for material cyber incidents in 2023. In Japan and abroad, cybersecurity is positioned as a matter for the board, not only for the technical department.

5-4. Constraints on users, and their unfairness

Even when compensation arrives, the lost opportunity of positions that could not be managed does not come back. A request to “please switch off your PC” is one form of the price users pay, in time and opportunity, when the cost of countermeasures is deferred. That social cost does not appear on the operator’s income statement.

6. What operators and executives can do now (general; based on public guidelines)

  1. Put a reporting line for cyber risk into the board. Each quarter, the board receives the list of open findings and the reasoning behind their priority.
  2. Give security findings a deadline. For findings from internal or external specialists, decide not “whether” but “by when, and to what depth”; findings past their deadline go on the agenda of the management meeting.
  3. Check the basics. Separation of privileged accounts and multi-factor authentication, restriction of remote-access routes, reliable deletion of environments and credentials after use ends, isolated backups, log monitoring. All of these appear in METI and IPA guidelines and apply to any operator.
  4. Design user communication for incidents in advance. Decide what to tell users, when, and through which channel. When asking users to act, attach an explanation that matches the burden being asked of them.
  5. Check how your site looks from the outside. The versions and security headers a server announces can be checked by anyone. In my “Security Exposure Survey 2026” (https://sitescouter.net/en/articles/security-exposure-statistics-2026), Japanese sites ranked last among 10 regions on all eight security controls.

7. Limits and caveats

  • This article is based only on public information (GMO’s notices, Kumagai’s blog, press reports, share prices, search suggestions). The intrusion route and cause await the official investigation report.
  • Claims made by the party claiming to be the attacker are unverified and are not treated as facts here.
  • Search suggestions indicate attention, not facts or cancellation numbers.
  • Share prices include the effect of the overall market and do not isolate the incident.
  • The affected FX firms and individual users are not identified.

8. Closing: put someone in charge who answers for the outcome

In his blog post of 25 October, Kumagai explained that internal white-hat hackers had flagged improvement items in advance, that the operations team had weighed availability and other priorities, and that the depth and speed of the response were insufficient (source: https://www.kumagai.com/?eid=19600). The structure in which security findings compete for priority with availability, revenue and deadlines exists at every operator. The price of that judgement grows with the time between the finding and the fix.

As a general matter, what is missing is not findings. It is an executive who takes the findings on board, decides the priority between availability and safety, and answers for the result. Listed companies need an executive responsible for information systems (a CIO) and an executive responsible for security (a CISO), so that it is clear who answers for the outcome. My superior has long proposed this; the present case shows why it is needed. Without such executives, the same pattern will repeat at any listed company.

Appendix: Primary sources, as captured on 27 October 2026

Published pages are sometimes revised, moved or removed later, so full-page screenshots of the primary sources this article relies on were saved as displayed on 27 October 2026. The source URL and capture date are given above each image. The pages are in Japanese.

Primary source 1. GMO Internet Group, Report 2 (published 22 Oct 2026)

Source: https://group.gmo/info/alert/20261022/ / Captured: 27 Oct 2026

gmo-report-2

Primary source 2. GMO Internet Group, Report 4 (published 24 Oct 2026)

Source: https://group.gmo/info/alert/20261024/ / Captured: 27 Oct 2026

gmo-report-4

Primary source 3. GMO Internet Group, notice (published 25 Oct 2026)

Source: https://group.gmo/info/alert/20261025/ / Captured: 27 Oct 2026

gmo-notice-1025

Primary source 4. Onamae.com, Report 1 (published 21 Oct 2026)

Source: https://www.onamae.com/news/article/11584 / Captured: 27 Oct 2026

onamae-report-1

Primary source 5. Masatoshi Kumagai’s blog (published 25 Oct 2026)

Source: https://www.kumagai.com/?eid=19600 / Captured: 27 Oct 2026

kumagai-blog

Disclosure

The author was previously at a GMO group subsidiary and held shares in the group at one time, but currently has no relationship with the group and holds no shares. This article is based solely on public information, and no information obtained during that employment has been used. It is not investment advice but part of the author’s effort to share information about security.

About the author and contact

Yuki Nakazawa (nkzw.jp), Japan.

2026.10.27 / written by Yuki Nakazawa

Update history

  • 1st edition (flash) published: October 27, 2026 12:38 JST
  • 2nd edition updated: October 27, 2026 12:40 JST (flash edition)
  • 3rd edition updated: October 27, 2026 12:41 JST (flash edition)
  • 4th edition updated: October 27, 2026 12:50 JST (flash edition)
  • 5th edition updated: October 27, 2026 14:21 JST (flash edition)
  • 6th edition updated: October 27, 2026 14:22 JST (flash edition)
  • 7th edition updated: October 27, 2026 17:12 JST (27 Oct close reflected)
  • 8th edition updated: October 27, 2026 19:02 JST (27 Oct close reflected)
  • 9th edition updated: October 27, 2026 19:02 JST (27 Oct close reflected)
  • 10th edition updated: October 27, 2026 19:05 JST (Figures 1 and 3 replaced with close-based versions)
Views: 16

前の記事

金融インフラが止まる日 ― 不正アクセス事案のサジェスト推移・…