Japanese internet and IT services company GMO Internet is conducting an investigation after detecting unauthorized access to its Onamae Desktop Cloud service, which provides virtualized desktops used by financial traders. The company said a suspected attacker has published information that appears to be linked to customers and to the business, though the authenticity of the posted material is still being verified and the full scope of the incident remains unclear.
GMO Internet has advised customers to reset their passwords after receiving reports of "unauthorized operations" on customer trading accounts. The company stated that as many as 27,000 servers may have been affected by the breach.
A GMO Internet spokesperson did not respond to TechCrunch’s request for comment.
Context: Artex tool and related activity
About a week before the Onamae incident, GMO Internet’s cybersecurity unit reported finding evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in attacks against companies across Japan. The company said it has not publicly established a connection between Artex and the Onamae breach.
CrowdStrike reported earlier this month that Artex was also used to compromise financial institutions in South Korea in September. Those attacks relied heavily on weak security controls, such as the absence of multi-factor authentication. Reuters has reported that the Chinese developer of Artex halted public updates and made the tool closed-source after it was linked to attacks on banks.
Regulatory guidance and response
A spokesperson for Japan’s Financial Services Agency (FSA) told TechCrunch that the regulator issued guidance in May urging financial institutions to prepare for an increase in cybersecurity vulnerabilities. The FSA recommended strengthening basic defenses — including vulnerability management, defense-in-depth and incident preparedness — and encouraged firms to use AI and other security tools.
Timeline
- Oct. 21, 2024: GMO Internet shut down the Onamae Desktop Cloud service after discovering unauthorized access to its systems. On the same day the company received an email from the attackers demanding roughly 8 billion yen (about $50 million).
- Oct. 22, 2024: GMO Internet reported the incident to Japanese police and published another public update.
- Oct. 24, 2024: The company said it would offer affected customers compensation and alternative services while seeking assistance from government agencies.
- Oct. 25–26, 2024: GMO Internet began collecting devices from customers to detect malware and better assess the damage.
- Oct. 27, 2024: The firm reported that a suspected attacker had posted information that appeared to be linked to the company and its customers; the company said it was still verifying whether the information was genuine.
Why it matters
Because Onamae Desktop Cloud serves financial traders, the incident poses direct operational and financial risks to customers. The potential involvement of up to 27,000 servers, reports of unauthorized trading operations, and a large ransom demand increase the seriousness of the breach. Coupled with recent reports about Artex and the FSA’s warnings, the case underscores the need for stronger basic security controls and preparedness in the financial sector, particularly as attackers incorporate AI-assisted tools.
The investigation is ongoing; GMO Internet has said it will share further details as they become available.
