Japanese internet and IT services company GMO Internet has confirmed it is investigating a data leak following what appears to be unauthorized access to its Onamae Desktop Cloud platform - a virtualized desktop service used primarily by financial traders. The company disclosed that a suspected attacker has published data online that may be linked to its customers and internal operations, though officials say the contents of the leaked material are still being verified and the full scope of the incident has not yet been determined.

In a statement published to its official blog, GMO Internet acknowledged the breach and urged affected customers to reset their account passwords as a precaution. The company also confirmed it had received reports of unauthorized activity carried out on customer trading accounts. According to GMO Internet, as many as 27,000 servers could be implicated in the breach.

A Ransomware Demand and Service Shutdown

The incident began on October 21, when GMO Internet took its Onamae Desktop Cloud service offline after detecting unauthorized access to its systems. Around the same time, the company received an email from the attackers demanding approximately 8 billion yen - equivalent to roughly $50 million - in what appears to be a ransomware-style extortion attempt.

The following day, on October 22, GMO Internet reported the incident to Japanese law enforcement and issued a public update to keep customers informed. By October 24, the company announced plans to offer affected customers compensation and access to alternative services, while also reaching out to relevant government agencies for assistance.

Between October 25 and 26, GMO Internet began collecting devices from customers in an effort to detect malware and better understand the full extent of the damage. Then, on October 27, the company confirmed that a suspected attacker had posted information online that appeared to be connected to the company and its customer base, though GMO Internet stated it was still working to verify whether the published data was authentic.

Links to a Chinese AI-Powered Hacking Tool

The Onamae breach occurred roughly one week after GMO Internet's own cybersecurity division separately reported discovering evidence that a Chinese AI-assisted penetration testing tool known as Artex had been used in cyberattacks targeting organizations across Japan. However, the company has not publicly established any direct link between the Artex tool and the breach of its Onamae platform.

Artex has drawn attention beyond Japan's borders as well. According to a report published earlier this month by cybersecurity firm CrowdStrike, the same tool was used in attacks against financial institutions in South Korea in September. Those attacks reportedly exploited weak security practices, particularly the absence of multi-factor authentication, to gain unauthorized access to targeted systems.

Following its association with attacks on banking institutions, Artex's Chinese developer ceased publishing public updates and transitioned the tool to a closed-source model, according to reporting by Reuters. The move effectively restricted access to the AI-powered security tool after it had been publicly tied to malicious activity.

Japan's Financial Regulator Issues Cybersecurity Warning

A representative from Japan's Financial Services Agency (FSA) confirmed that the regulator had issued guidance back in May urging financial institutions to prepare for an expected increase in cybersecurity threats and vulnerabilities. The guidance called on firms to strengthen fundamental security defenses, including vulnerability management, layered defense strategies, and incident response preparedness. The FSA also encouraged organizations to adopt artificial intelligence and other modern security tools as part of their broader defensive posture.

The timing of the FSA's earlier warning now appears particularly relevant given the wave of AI-assisted cyberattacks that have since targeted financial entities across Japan and South Korea. The Onamae breach serves as a pointed reminder of the risks facing cloud-based services that cater to the financial sector, especially when foundational security controls are not adequately enforced.

Timeline of the Onamae Breach

• October 21: GMO Internet shuts down the Onamae Desktop Cloud service after detecting unauthorized access. The company also receives an extortion email demanding approximately 8 billion yen (around $50 million).
• October 22: GMO Internet files a report with Japanese police and publishes an update for the public regarding the incident.
• October 24: The company announces plans to compensate affected customers and provide access to alternative services, while engaging government agencies for support.
• October 25-26: GMO Internet begins retrieving devices from customers to scan for malware and assess the extent of the damage.
• October 27: The company confirms that a suspected attacker has published data online that appears to be linked to GMO Internet and its customers. The company states it is still in the process of verifying the authenticity of the published information.

As the investigation continues, the incident highlights the growing threat posed by sophisticated, AI-enabled hacking tools to cloud infrastructure providers and the financial services firms that depend on them. GMO Internet has not yet provided a definitive assessment of the full damage or confirmed the identity of those responsible for the attack.