GMO Onamae.com Desktop Cloud (FX trading VDI) breached: stored broker logins used for unauthorized trades, $50M extortion

GMO Internet's Onamae.com Desktop Cloud is a Windows virtual-desktop service used to run MT4/MT5 FX auto-trading tools. It was breached: GMO found malicious programs on customer servers on 2026-10-20 and shut down every plan on 2026-10-21. Up to 26,739 servers may be affected (GMO's upper bound). Trading and brokerage credentials stored on those servers were stolen and used for unauthorized trades at several brokers. GMO confirmed customer data was exfiltrated. The attacker demanded about JPY 8B ($50M) and threatened more trading across 70+ brokers, data leaks, and ransomware on customers' connected PCs. GMO refused to pay. After the 2026-10-27 deadline the attacker published data it says belongs to GMO and its customers. So far GMO has found no malware on the customer PCs it has analysed. How the attacker got in: unknown. At risk: anyone who used the service or stored credentials on it, and any PC that connected to it over RDP.

Summary written from the sources below. Check the originals before acting.