{"id":896330,"date":"2026-10-27T12:14:13","date_gmt":"2026-10-27T12:14:13","guid":{"rendered":"https:\/\/www.newsbeep.com\/us\/896330\/"},"modified":"2026-10-27T12:14:13","modified_gmt":"2026-10-27T12:14:13","slug":"japanese-virtual-desktop-cloud-hacked-so-hard-it-asks-to-be-banned","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us\/896330\/","title":{"rendered":"Japanese virtual desktop cloud hacked so hard it asks to be banned"},"content":{"rendered":"<p>Japanese ISP GMO Internet has warned customers the cloudy desktop service it offers as an ideal foreign exchange trading environment was compromised by an attacker, and that it had been slow to improve the service&#8217;s security.<\/p>\n<p>GMO runs a service called Onamae.com Desktop Cloud and last week <a href=\"https:\/\/internet.gmo\/en\/news\/article\/246\/\" target=\"_blank\" rel=\"nofollow noopener\">admitted<\/a> \u201ca third party had installed malicious programs in the server environments of some customers.\u201d That\u2019s never welcome news but is an especially poor outcome because the servers host cloudy Windows desktops that GMO recommends customers use to host foreign exchange trading applications.<\/p>\n<p>In later updates the company <a href=\"https:\/\/internet.gmo\/en\/news\/article\/247\/\" target=\"_blank\" rel=\"nofollow noopener\">revealed<\/a> that some customers reported \u201cunauthorized operations were performed on their trading accounts\u201d and advised that third parties had probably seen users\u2019 passwords for trading services.<\/p>\n<p>The next day, the company <a href=\"https:\/\/internet.gmo\/en\/news\/article\/248\/\" target=\"_blank\" rel=\"nofollow noopener\">advised<\/a> users to immediately change passwords for their trading accounts, and to do so using a device that they don\u2019t use for trading.<\/p>\n<p>The company has since admitted that its Onamae.com Desktop Cloud service\u2019s \u201csystems had security vulnerabilities, that its environment was accessed without authorization, and that customer information was taken outside the Company.\u201d<\/p>\n<p>\u201cSome customers have also reported transactions in their trading accounts that they do not recognize.\u201d<\/p>\n<p>Those transactions have GMO sufficiently worried that it contacted major trading services, asked them to forcibly terminate all active sessions, monitor for unauthorized transactions, and to block trade requests coming from the Onamae.com Desktop Cloud.<\/p>\n<p>Not paying, or complaining<\/p>\n<p>GMO said it has \u201creceived a demand for money from a person believed to be the attacker. We have also been told that, if we refuse, the attacker will take actions such as publishing information about the Company and our customers.\u201d<\/p>\n<p>The attacker wants $50 million.<\/p>\n<p>The company won\u2019t pay because it feels \u201ccomplying would not guarantee that the obtained information is deleted or that its misuse is prevented.\u201d<\/p>\n<p>Investigations into the incident continue, with GMO warning that 26,739 VDI servers may have been hit by the attack, and that users\u2019 personal devices may be at risk.<\/p>\n<p>The company is offering all users a \u00a55,000 ($32) condolence payment and promised to make good on any trading losses caused by the attack.<\/p>\n<p>This incident may have quite a blast radius, as GMO has warned that some trading apps may keep sessions alive even after passwords change. \u201cCheck your securities or FX company&#8217;s guidance or your account page, and either disconnect all active sessions or ask the company&#8217;s support desk to disconnect them,\u201d GMO advised.<\/p>\n<p>            Our response lacked sufficient depth and speed, allowing the attackers to exploit the vulnerability<\/p>\n<p>That \u00a55,000 isn\u2019t going to get anywhere near paying for the work customers will do to sort this out.<\/p>\n<p>GMO CEO Masatoshi Kumagai acknowledged that in a <a href=\"https:\/\/www.kumagai.com\/?eid=19600\" rel=\"nofollow noopener\" target=\"_blank\">blog post<\/a> in which he described the payment as \u201ca token of our initial sincerity towards our customers who have experienced inconvenience and worry.\u201d<\/p>\n<p>\u201cWe will dedicate the full resources of our group to providing a free alternative environment for six months, fundamentally overhauling our system infrastructure, and conducting a thorough investigation into the cause and preventing recurrence with the help of external experts,\u201d he added.<\/p>\n<p>But he also admitted that GMO knew the service\u2019s security could be improved.<\/p>\n<p>\u201cOur in-house white-hat hackers had previously pointed out areas for improvement to the team,\u201d he wrote. \u201cThe team took these points to heart and was working on countermeasures.\u201d<\/p>\n<p>\u201cHowever, while we proceeded cautiously, considering the impact on service availability and prioritizing other issues, our response lacked sufficient depth and speed, allowing the attackers to exploit the vulnerability. I deeply regret that, despite having professionals on staff, we failed to fully translate their expertise into effective defenses as an organization.\u201d<\/p>\n<p>The CEO also said GMO can\u2019t secure itself without government help.<\/p>\n<p>\u201cI&#8217;ve been involved in this world for 31 years, since the dawn of the internet industry,\u201d he wrote. \u201cThe cyberspace that I built with my colleagues, believing it would bring smiles to people&#8217;s faces, is now on the verge of being completely destroyed by malicious actors.\u201d<\/p>\n<p>\u201cThe ease with which open weight AI models can be combined and spread into countless attack tools has transformed cyberattacks, which once required advanced skills, into an era where anyone can easily carry them out,\u201d he added, before claiming that GMO Group\u2019s cybersecurity operation \u201chas confirmed that the source of an unauthorized access attack targeting approximately 20 Japanese companies was the misuse of \u2018ARTEX,\u2019 an autonomous AI penetration testing tool originally intended for defense.\u201d<\/p>\n<p>Kumagai thinks public\/private partnerships are needed to improve infosec across Japan.<\/p>\n<p>\u201cYesterday, we submitted a proposal to the government to \u2018apply proactive cyber defense,\u2019\u201d he wrote.<\/p>\n<p>\u201cWe are by no means trying to shift the blame for our company&#8217;s actions onto the government and beg for a bailout,\u201d he wrote, but argued that unless Japan implements national-level defenses, more such incidents are unavoidable. \u00ae<\/p>\n<p>\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"Japanese ISP GMO Internet has warned customers the cloudy desktop service it offers as an ideal foreign exchange&hellip;\n","protected":false},"author":2,"featured_media":896331,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[28],"class_list":["post-896330","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","tag-business"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/896330","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=896330"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/896330\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/896331"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=896330"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=896330"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=896330"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}