Cyberattack hits GMO Internet Group

A major cyberattack targeted GMO Internet Group, a major Japanese technology and internet services company. The attack compromised around 27,000 servers and involved malware that stole trading credentials from over 70 brokerage firms. The hackers issued demands for unauthorized trades, data disclosure, and a $50 million ransom, which GMO refused to pay.

Attack began on October 21, 2026

The attack started on October 21, 2026, when GMO Internet began shutting down its Onamae.com Desktop Cloud servers after they were infected with malware. The hackers used the stolen credentials to carry out fraudulent trades. Four days later, the company’s founder, Masatoshi Kumagai, published a blog post describing the incident as a sign that "the internet itself is breaking."

Founder blames AI-driven attacks

Kumagai attributed the attack to "AI-driven saturation attacks," where open-source AI models are used to conduct mass hacking. He cited a software called ARTEX, an autonomous intrusion testing tool developed in China for defense purposes, as being behind attacks on several Japanese companies.

GMO seeks government intervention

GMO has requested the Japanese government to activate its active cyber defense law, enacted on October 1, 2026. This law allows police and the Self-Defense Forces to neutralize enemy servers. The company also stated that internal ethical hackers had previously warned about vulnerabilities, but responses were delayed to maintain service availability.

Skeptics question AI's role

Some reports have cast doubt on the extent of AI's involvement in the attack. ITmedia noted that no evidence has been presented to confirm AI's role. On social media, some users accused GMO of shifting blame onto the government for its own management failures. The attackers claimed to have exploited a shared administrator account across all servers, a claim that GMO has not confirmed.

GMO offers compensation

Kumagai has pledged to cover the costs of the attack, offering 5,000 yen (about 30 euros) per affected customer, full reimbursement of verified losses, and six months of free hosting services.