In disclosures issued on October 23, GMO Internet Group and GMO Internet said unauthorized software had been found in certain Onamae.com Desktop Cloud customer-server environments following its discovery on October 20. The incident may affect 26,739 servers. The filings state that trading-account login credentials and other data stored on those servers may have been obtained and used without authorization. A separate claim concerning GMO Coin account activity has not been corroborated by a reviewed GMO Coin notice.

What GMO has officially confirmed about the breach

GMO’s official disclosures identify Onamae.com Desktop Cloud as the affected service, rather than describing a group-wide breach spanning all GMO businesses. The company said it confirmed on October 20 that a third party had installed an unauthorized program in server environments used by some customers of the service.

On October 23, GMO said all Onamae.com Desktop Cloud plans were within the scope of its review and that 26,739 servers could potentially be affected. The company also emphasized an important distinction: the figure represents the number of servers that may have been affected, rather than evidence that every server was actually misused.

The official filings describe the confirmed risk more specifically than a general hacking report. GMO said trading-account login information and other data held on affected customer servers may have been obtained by a third party and used without authorization.

What the incident does and does not show about GMO Coin

The reviewed official disclosures do not identify GMO Coin as the breached service. They focus on Onamae.com Desktop Cloud and the possibility that credentials and other data stored in customer-server environments were obtained and misused.

The only GMO Coin-specific point supplied is the flash report’s attribution that no abnormal customer-account operations were found. This is narrower than saying GMO Coin customer data, systems, or infrastructure were unaffected. No corresponding GMO Coin notice was reviewed here to clarify the scope further.

This distinction is relevant to the central question of whether GMO Coin was directly confirmed as breached. Based on the official disclosures, the confirmed breach concerns the cloud desktop service. As currently presented, the GMO Coin claim supports only a limited conclusion regarding account activity, not a comprehensive assurance on data exposure or platform impact.

What users were told to do next

GMO’s official guidance was specific and practical. Users were advised to change passwords for brokerage accounts, FX trading tools, and related trading accounts, and to log out of or disconnect active sessions.

The guidance indicates where GMO saw the immediate risk: credentials used through the affected cloud-server environment. It also explains why the 26,739-server figure should not be read as the number of confirmed stolen accounts, but rather as the outer scope of systems that may require defensive measures.

On the ransom issue, GMO’s refusal to meet the attackers’ demands is supported by official company materials and contemporaneous reporting. The Mainichi reported on October 27, citing GMO CEO Masatoshi Kumagai and company statements, that the attacker demanded $50 million in cryptocurrency and that GMO would not pay. The later flash claim that the demand fell to $1 million has not been established in the reviewed primary disclosures.