Japanese internet provider GMO Internet has disclosed a major security incident affecting its Onamae.com Desktop Cloud service, in which attackers gained unauthorized access to virtual desktop infrastructure and planted malicious software used to execute unauthorized trades on customer accounts. The company says it will not pay the $50 million ransom demanded by the attacker, who has threatened to leak stolen corporate and customer data.
How the breach unfolded
According to details reported by The Register, the intrusion targeted virtual desktop environments tied to the Onamae.com Desktop Cloud service, with as many as 26,739 servers potentially exposed. Once inside, the attackers installed malware that allowed them to manipulate customer trading sessions, turning a cloud infrastructure compromise into direct financial fraud against end users. GMO says it is now coordinating with trading platforms to forcibly terminate active sessions tied to the compromised environment and to block network traffic originating from affected systems, an effort aimed at cutting off the attacker's ongoing access rather than simply patching the original entry point.
A known weakness left unaddressed
GMO Internet CEO Masatoshi Kumagai acknowledged that the company's internal security teams had already flagged the vulnerabilities exploited in this attack before the breach occurred, but that remediation did not happen fast enough to prevent exploitation. This admission points to a common failure mode in enterprise cloud security: identifying risk is not the same as closing it, and the gap between detection and fix can be the window attackers need. For a service managing tens of thousands of virtual servers, even a short delay in patching can translate into large-scale exposure.
AI-assisted intrusion raises the stakes
GMO has linked the attack to the misuse of autonomous penetration-testing tools, framing the incident as an example of AI-driven cyberattacks that can probe and exploit weaknesses faster than traditional manual methods. If accurate, this reflects a broader shift in the threat landscape, where tools originally built to help defenders find flaws are being repurposed by attackers to scale reconnaissance and exploitation. GMO has not detailed the specific tooling or methodology involved, and that part of the account should be treated as the company's characterization of the incident rather than independently confirmed technical analysis.
Response and policy implications
GMO says it is offering compensation to customers affected by the unauthorized trading activity and has refused the ransom demand, citing the lack of any guarantee that paying would secure stolen data. The company has also proposed that the Japanese government adopt a national proactive cyber defense strategy, positioning the incident as evidence that reactive security postures are insufficient against fast-moving, possibly automated attacks. For enterprises running cloud-based virtual desktop services more broadly, the episode is a reminder that timely vulnerability remediation, rapid session revocation capabilities, and clear ransom-refusal policies are increasingly central to limiting damage once an intrusion occurs.