Japan cyberattack database

On 20 October GMO Internet found that a third party had placed a malicious program on some customer servers of Onamae.com Desktop Cloud, its Windows remote desktop service. 26,739 servers may be affected, and it began shutting down servers on all plans from 04:00 on 21 October. Login details for trading tools such as FX platforms saved on the servers were used, and customers reported trades in their accounts that they had not made. Its fourth report on 24 October admitted a security flaw in the service's systems and confirmed customer data was taken out. It will pay every user a flat ¥5,000, compensate realized losses from unauthorized trades and offer a replacement service free for six months. It consulted the police and asked the government to respond with active cyber defence measures. On 25 October group chairman and CEO Masatoshi Kumagai apologized on his blog, admitting that in-house engineers had raised security issues with the service that were not dealt with in time. The damage may reach users' own PCs. According to GMO's user guide, the RDP connection files it handed out turned on file sharing with the user's PC by default, which lets the server side see the drives of the user's own computer. From 25 October GMO collected users' PCs across Japan for analysis; its ninth report at 11:59 on 27 October said no malware had been found on the devices analysed so far. GMO's timeline says a threatening email on 21 October demanded about ¥8 billion. Kumagai wrote on his blog on 26 October that the demand was USD 50 million in crypto assets (Sankei Shimbun). The apparent attacker later demanded USD 1 million by noon on 27 October and threatened to publish users' data and launch ransomware attacks if not paid (ITmedia NEWS). TV Asahi reported the attackers claim to have planted a backdoor that lets them back into users' PCs without logging in; this is an unverified claim, and GMO has not confirmed any intrusion into users' PCs. GMO says it will not pay. Its eighth report on 27 October asked users to back up their data, disconnect their PCs from the network and switch them off before noon, and it will give users hit by ransomware an equivalent new PC. According to its tenth report, at 12:30 on 27 October GMO confirmed that the apparent attacker had published information it claims concerns GMO and its customers. GMO is checking the content, warns it may contain false information, asks people not to access or share it and is preparing legal action against malicious spreaders. It will contact customers whose data is included and is considering steps beyond the flat payment. As of 13:55 no ransomware attack had been confirmed. Its eleventh report at 14:55 said it had confirmed that the attacker collects data on anyone who visits the attacker's site, repeated its request not to visit it and advised those who had to run a full antivirus scan. On 27 October Financial Services Minister Katayama named five FX firms that reported customer damage thought to be linked to GMO: Goldenway Japan, OANDA Securities, AvaTrade Japan, Gaitame Finest and Dukascopy Japan. Trading account logins stored on the servers appear to have been taken and used for unauthorized trades. The firms suspended trading for affected customers and blocked unauthorized orders. Amounts were not disclosed. The Goldenway Japan case is covered as a separate incident.

Latest source 2026-10-27 · GMO Internet Group 【重要】「お名前.com デスクトップクラウド」への不正アクセスに関する現在の対応について（第8報）（【続報】お客様をお守りするために現在私たちが行っていること）

Details of two critical flaws in PHP leaked before the fix, and ministries, local governments, banks and companies across Japan paused websites and services as a precaution.

[Precautionary halt]

Hiroshima Prefecture,Ibaraki Prefectural Police,Iwate Prefecture,NTT DOCOMO, Inc.,SoftBank Corp.,Aomori Michinoku Bank, Ltd.,Itabashi City,Kasukabe City

600 more

Latest source 2026-10-26 · Miyagi Prefecture 宮城県が管理・利用するウェブサイト・システムの一部停止について（令和8年10月21日に発覚したPHPの脆弱性対応）