Japanese internet infrastructure firm GMO Internet has pledged to reimburse customers for financial losses stemming from a cyberattack on its cloud service, and will make a symbolic goodwill payment of ¥5,000 (€28) to every user of the affected platform.
The breach targeted Onamae.com Desktop Cloud, a virtual private server service that lets customers access remote Windows environments. GMO said attackers stole customer information and that some users reported unauthorized transactions in their trading accounts. The company’s founder and CEO, Masatoshi Kumagai, said the incident potentially affected 26,739 servers and involved unauthorized operations on accounts held with more than 70 securities and foreign-exchange firms in Japan and abroad.
News of the attack hit GMO’s share price hard: on Monday, the stock dropped nearly 16% to a four-month low, giving the company a market value of roughly $2.6 billion at Friday’s close.
Investigation and response
GMO began investigating on 19 October after a customer inquiry. The next day, it confirmed that a malicious program had been installed on some customer server environments. The company suspended new applications and access to the service’s control panel, and began shutting down all servers on 21 October to prevent further damage.
In a blog post on Sunday, Kumagai apologised for the company’s response, admitting that its own security specialists had flagged issues before the incident but that the response had been insufficient. He also revealed that the attackers had demanded $50 million in cryptocurrency and threatened to disclose company and customer information. GMO has refused to pay and is cooperating with the police and other authorities.
For customers who wish to continue using a Windows desktop environment, GMO will offer an alternative service on independent cloud infrastructure, free for six months. The company also plans to overhaul its security architecture and investigate the root cause with external experts.
Kumagai has urged the Japanese government to strengthen its active cyberdefence measures, arguing that private companies cannot tackle sophisticated cross-border cyberattacks alone. He has asked authorities to consider applying the framework to this incident and has offered to share evidence and technical information with investigators.
The attack comes amid broader concerns about cybersecurity. Last week, two critical vulnerabilities were disclosed in PHP, a programming language widely used to build websites and applications. Security authorities warned that the flaws could allow attackers to execute malicious code on vulnerable servers, prompting organisations worldwide to patch systems or temporarily take services offline. GMO has not publicly confirmed a link between the PHP vulnerabilities and the attack on its cloud service.
This incident underscores the growing threat landscape that European firms also face. As European companies confront widening security threats, the GMO case serves as a reminder that even well-resourced infrastructure providers can be vulnerable. The company’s decision to compensate customers and offer free alternative hosting is a notable step, though it may not fully restore trust.
For European readers, the episode highlights the importance of robust cybersecurity measures and the potential consequences of breaches, especially for firms that handle sensitive financial data. As cloud and AI infrastructure expands across Europe, the need for resilient security architectures becomes ever more critical.
