Intruders compromised Onamae.com Desktop Cloud, a service that provides rented Windows servers to traders running automated foreign-exchange trading tools like MT4 and MT5. The attackers subsequently demanded ransom and threatened to continue executing unauthorised trades through accounts across more than 70 securities and FX firms operating in Japan and internationally.
GMO Internet Group submitted a formal request to Japan's government on Saturday to deploy its recently enacted active cyber defence capabilities against those responsible for the intrusion. The filing with the stock exchange outlined the company's request for state agencies to identify, obstruct, and neutralise the attackers' technical infrastructure—marking what would be the first deployment of these powers since they became operational on 1 October amid a broader surge in data breaches.
The compromised platform may have affected as many as 26,739 servers, according to GMO's incident disclosure. Malicious code installed on certain customer systems potentially exposed trading credentials stored on those machines. Beginning 22 October, customers began noticing unauthorised transactions executed through their accounts.
Beyond demanding payment, the attackers warned they would maintain their ability to place unwanted orders, publish confidential customer and corporate information, and deploy ransomware attacks. GMO has declined to meet the financial demands, reasoning that payment offers no assurance that stolen data would be destroyed or that its misuse would cease. The company has filed a police complaint and cautioned that any data the attackers release may contain inaccuracies.
GMO instructed major trading venues and brokers to revoke access to the service and terminate all existing connections. On 22 October, OANDA Japan notified its customers that credentials used on the platform might have been compromised, and temporarily restricted withdrawal activity pending security verification.
Japan's new legislation permits law enforcement and the Self-Defense Forces to penetrate attackers' infrastructure and render it inoperable before harm escalates, according to reporting by Jiji Press. However, GMO does not fall within the category of critical infrastructure operators designated under the law, as noted by Impress Watch.
GMO will distribute ¥5,000 (approximately $32) to all active users of the service regardless of whether they experienced financial losses. The company will also reimburse confirmed losses from unauthorised transactions, subject to any compensation already received from brokers. The platform will not resume operations; customers may transition to an alternative cloud offering at no cost for half a year. GMO plans to release details regarding the claims procedure by 6 November, though the total financial impact remains uncertain at this time.
Source: The Next Web
