GMO Internet Group said in disclosures dated October 23 and October 24 that unauthorized access affected Onamae.com Desktop Cloud, prompting server suspensions from October 21 and a compensation plan for losses from unauthorized transactions. This is the latest official status in the supplied materials. They do not confirm that customer information was publicly leaked, despite media reports of an alleged ransom demand and data-disclosure threat.

What GMO Has Officially Confirmed So Far

GMO has officially confirmed unauthorized access affecting Onamae.com Desktop Cloud, saying an unauthorized program was found in some customers’ server environments. To contain the incident, it suspended all Desktop Cloud plans from October 21. In its October 23 disclosure, the company said it began investigating after a customer inquiry on October 19 and confirmed on October 20 that a third party had installed the program.

The company also said it suspended new applications and control-panel functions on October 20, before sequentially suspending servers across all Onamae.com Desktop Cloud plans from 04:00 on October 21. This distinction matters: the scope confirmed in the supplied primary materials is limited to Onamae.com Desktop Cloud, rather than all Onamae.com domain and cloud services.

GMO further disclosed that 26,739 servers were potentially affected as of 16:10 on October 23. In the company’s wording, this is a server count, not a confirmed number of affected customers, exposed records, or compromised trading accounts.

Were Customer Data Leaks and Unauthorized Trades Confirmed?

At the company-response level, losses from unauthorized transactions are effectively confirmed because GMO announced compensation and goodwill payments. However, the supplied primary materials do not confirm that customer information was publicly leaked. This is the clearest divide between what readers can treat as official and what remains media-attributed reporting.

GMO’s October 24 notice announced goodwill payments to customers and compensation for losses from unauthorized transactions following the unauthorized access. This goes beyond isolated customer complaints, showing that the company recognized transaction-related harm and launched a formal remediation process. The supplied materials, however, do not state the total number of affected accounts or aggregate losses.

By contrast, the reported ransom demand and disclosure threat remain media-attributed in the supplied evidence. Euronews reported that GMO received a $50 million demand and a threat to disclose company and customer information. GMO’s supplied primary disclosures do not independently confirm that amount or an actual public release of customer data. The same distinction applies to ransomware: the supplied primary materials confirm unauthorized access and service disruption, not a completed ransomware outcome.

How the Incident Timeline Developed After October 19

GMO’s disclosed timeline begins with a customer inquiry on October 19, followed by confirmation of an unauthorized program on October 20 and a broad shutdown of Onamae.com Desktop Cloud services beginning early on October 21. This chronology is more firmly established than broader claims of a generalized breach affecting all GMO online services.

The company says it started investigating after the October 19 inquiry, confirmed the unauthorized installation on October 20, halted new applications and control-panel functions that same day, and then sequentially suspended servers across all Desktop Cloud plans from 04:00 on October 21. On October 24, it shifted from technical containment to customer remediation by announcing compensation for losses from unauthorized transactions.

The next meaningful update would be a further notice from GMO or regulators clarifying whether customer information was actually exposed and when affected services can safely resume. Separate reports have also claimed that customers of five FX firms were affected, but no reviewed primary regulatory record in the supplied materials establishes that point clearly enough to support the story.