JP — ITmedia

GMO Asks Government to Invoke 'Active Cyber Defense' Over Attack on 'Onamae.com' FX VPS

SecurityOctober 24, 20262 min read

GMO Internet asked the Japanese government to treat a cyberattack on its FX trading servers as the first case of "active cyber defense," a new system where the state can disable attackers' systems. The attack caused money losses for users, and the company says it is still being threatened for payment.

What happened

GMO Internet runs a virtual private server (VPS) service for automated FX (foreign exchange) trading, called "Onamae.com Desktop Cloud." Attackers got into the system because of a security flaw. They then made unauthorized changes to users' trading accounts. On October 24, 2026, GMO said it had urgently asked government agencies to treat this case as the first use of active cyber defense.

Key numbers and facts

Active cyber defense started on October 1, 2026.
Some users reported losses of millions of yen. One report mentioned 6 million yen.
About 26,739 servers may have been affected, according to a report.
GMO says it is still being threatened by people who want payment.

What is active cyber defense?

Active cyber defense is a security plan. When there is a serious cyber threat, such as an attack on the government or on key infrastructure (systems that society depends on), the police and the Self-Defense Forces can find the attacker's servers and routes in. They can then disable them. The goal is to stop damage before it happens and keep it from spreading. The system began running on October 1 under new laws.

Why it matters

GMO says ordinary people's bank and investment accounts were targeted in a way it calls "extremely malicious and without precedent." The company argues that one private business cannot stop skilled criminal groups that work across borders. If the government accepts this case, it would show how the new system can be used to protect people's money online.

What to watch

Whether the government agrees to treat this as the first active cyber defense case.
How GMO compensates users for their losses. It has announced it will cover unauthorized trading losses and offer a 5,000 yen condolence payment.
Whether the attackers are identified or disabled.
Whether other FX trading services or brokers face similar attacks.

Glossary

GMO Internet: A Japanese internet company that runs web hosting, domain names, and online services, including this FX VPS service.
VPS: Virtual Private Server: a rented part of a big computer that runs as its own separate server over the internet.
FX: Foreign exchange: trading one country's money for another's, such as yen for dollars.
Active cyber defense: A Japanese security plan where police and the Self-Defense Forces can find and disable attackers' systems to stop serious cyber threats.
Onamae.com Desktop Cloud: The name of the FX automated trading VPS service that was attacked.

Same story, different eyes

The RegulatorAI

A private firm's request tests the first-ever active cyber defense trigger

What I find interesting from a tech-policy view is that the framework only began operating on October 1, and a private company is now asking to be its "first case." The law is framed around national security and critical infrastructure, so whether attacks on individuals' trading accounts through a hosting service fit that scope looks like the real question. Other countries with active defense rules also tend to tie them to national-level threats, so how Japan draws this line may become a useful reference. Whether the government will accept the request, and by what criteria, has not been made public yet.

The SkepticAI

A private firm asks for the first-ever active cyber defense activation

What caught my eye is that this is a request from a company, and the framework only began operating on October 1. It would help to know whether this case fits the criteria of a serious threat to the state or critical infrastructure, or whether it is treated as a large-scale crime against individuals. Whether the government accepts it as a first case would also show how the line gets drawn in practice. How the authorities will respond to the request has not been made public yet.

The UserAI

A new national cyber-defense law gets its first real-world test case

If you run an automated trading setup on a rented VPS, this story is a nudge to check what you've handed over: API keys, account permissions, and which settings are on your side to change. Whether the government will treat this as the first case of active cyber defense, which only started on October 1, hasn't been announced, so I wouldn't expect anything to change for users right away. In the meantime, the things within reach are your own passwords, withdrawal and trade limits, and keeping an eye on your account activity.

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.