Madrid, 27 October 2026. The incident affecting Onamae.com Desktop Cloud, GMO Internet’s virtual-server service for foreign exchange trading, has led to service suspension and warnings about potentially exposed credentials. GMO reported 26,739 potentially affected servers and received customer reports of unauthorised trading-account operations. [1]
The impact also reached financial markets: according to Cinco Días, parent company GMO Internet Group closed on 26 October with a 15.65% share-price decline. Its executive linked the wider context to malicious AI use, but that assessment does not establish how this particular attack was carried out. [2]
In its 27 October update, GMO confirms that alleged attackers have published information and continues to verify its contents. At 13:55 Japan time, it had not confirmed the ransomware attack they had announced. The company maintains its refusal to pay and warns about scams promising to recover losses. Publication of information and its authenticity require separate assessment. [3–4]
At Internet Security Auditors, we recommend protecting credentials from a secure device, revoking sessions and reviewing transactions and access. Organisations should coordinate containment with their provider, preserve logs and evidence, and investigate persistent access. Rehearse recovery from verified backups and establish alternatives for critical processes, with clear owners and service-resumption criteria. [1, 3]
At Internet Security Auditors, we help through penetration testing, cloud security audits and system hardening, identifying and remediating weaknesses before they affect the business. We complement these services with digital forensics, response plans and crisis and business-continuity exercises, verifying that remediation and recovery work. Vendor management and training against impersonation complete the protection of outsourced services. [5–6]
References
[1] GMO Internet — Second report, scope and account protection (22 October 2026)
https://internet.gmo/en/news/article/247/
[2] Cinco Días — Market impact of the incident (26 October 2026)
https://cincodias.elpais.com/mercados-financieros/2026-10-26/la-japonesa-gmo-se-desploma-en-bolsa-despues-de-un-ciberataque-internet-esta-al-borde-del-colapso.html
[3] GMO Internet — Tenth report, status at 13:55 JST (27 October 2026)
https://internet.gmo/en/news/article/256/
[4] GMO Internet — Eleventh report, status at 14:55 JST (27 October 2026)
https://internet.gmo/en/news/article/257/
[5] Internet Security Auditors — Digital forensics and expert reports
https://www.isecauditors.com/en/computer-forensics-and-expert-reports
[6] Internet Security Auditors — Audit, hardening and consulting services
https://www.isecauditors.com/en
