GMO Internet Group requests Japan’s active cyber defence after breach affecting 26,739 servers

What triggered the request for state intervention

GMO Internet Group asked Japan’s government to activate its new active cyber defence powers after attackers breached its Onamae.com Desktop Cloud service. The service, which rented Windows servers to traders using automated foreign-exchange tools like MT4 and MT5, was compromised, potentially exposing up to 26,739 servers. Attackers planted malicious software on some customer servers, which may have accessed stored trading logins.

From 21 October, customers reported unauthorised trades executed through their accounts. The attackers demanded payment and threatened further unauthorised trades, data leaks, and a ransomware attack if their demands were not met. GMO refused to pay, citing concerns that payment would not guarantee the deletion of stolen data or prevent its misuse.

How the new cyber defence powers apply

Japan’s new cyber defence framework, effective 1 October, allows police and the Self-Defense Forces to trace, block, and neutralise attackers’ servers to prevent further damage. This marks the first potential use of these powers since their enactment. The law targets critical infrastructure operators, but GMO is not designated as one, meaning the request for intervention is being evaluated outside standard protocols.

While the law primarily covers operators deemed essential to national security, the government’s willingness to consider GMO’s request signals a possible expansion of its application. The outcome could set a precedent for how similar cases are handled in the future.

GMO’s response and customer compensation

GMO has taken multiple steps to mitigate the breach’s impact. It asked police to open a criminal investigation and coordinated with major exchanges and brokers to block access from the compromised service. OANDA Japan, a partner, temporarily halted withdrawals for a security review after confirming potential exposure of MT4 and MT5 logins.

The company confirmed it will not revive the Onamae.com Desktop Cloud service. Instead, it will compensate affected customers with ¥5,000 each, regardless of whether they incurred financial losses. GMO will also cover realised losses from unauthorised trades, minus any refunds already issued by brokers. The claims process will be detailed by 6 November, though the company has not yet estimated the total financial impact.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This incident highlights the practical challenges and risks of invoking new cyber defence powers, especially for companies outside critical infrastructure sectors. For founders and operators, the case underscores the importance of preparing for state-level responses to cyber incidents, even if their business is not formally designated as essential. The refusal to pay ransom—while aligning with global cybersecurity recommendations—also demonstrates the potential financial and operational fallout of such breaches, including compensation costs and service disruptions. For Japan’s tech and financial sectors, the government’s response to GMO’s request could clarify how flexibly these powers will be applied in future cases.

Related on Lazyfounder

• More technology news