Ransom Demand Made to GMO After Unauthorized Access; Government Urged to Adopt "Active Cyber Defense"

What happened

Attackers got into GMO Internet's "お名前.com Desktop Cloud" service. This service included a VPS (a rented virtual computer) made for automatic foreign exchange (FX) trading. Some users' servers had harmful programs installed. These programs may have let outsiders take login details for FX and other trading accounts, and then use those accounts without permission. GMO found the problem on October 20, 2026, and has been fixing it since then. It has asked users to change their passwords and log out of all active sessions.

Key numbers and facts

• 26,739 servers may have been affected.
• GMO will pay every user a flat 5,000 yen as a goodwill payment, whether or not they lost money.
• Users get 6 months of free service, plus a replacement service.
• Application details for loss compensation will be sent by November 6, 2026.
• The attackers asked for money and threatened to publish data and carry out ransomware attacks. They also said they would keep manipulating trading accounts at more than 70 securities and FX companies in Japan and abroad.

Background

"Active cyber defense" is a new Japanese law that took effect on October 1, 2026. It lets the government and companies work together more closely, use communication data, and even disable attacking servers. It covers 15 types of critical infrastructure, such as power, water, banking, and telecom. GMO Internet's group is not on that list.

Why it matters

This case is different from usual hacks. The attackers did not just lock up data or steal information. They went after ordinary people's money in trading accounts. GMO says a single company cannot stop criminal groups that work across borders. So it wants the government to lead the effort to track down and shut down the attack systems. GMO calls this the first case under the new law.

What to watch

• Whether GMO pays refunds to users who lost money, and how much.
• Whether the government uses its new active cyber defense powers in this case.
• Whether the attackers carry out their threats to publish data or launch ransomware.
• Whether the trading companies and police find and stop the attackers.