GMO Internet Investigates Massive Data Leak on Onamae Cloud Desktop Service

GMO Internet, one of Japan’s largest IT and internet service providers, confirmed that attackers gained unauthorized access to its Onamae Desktop Cloud service, a virtualized desktop offering used heavily by financial traders. The company estimates that roughly 27,000 servers may have been compromised, and it has urged all customers to reset passwords immediately.

Following the discovery on 21 October, GMO shut down the service, reported the intrusion to police, and received a ransom note demanding about 8 billion yen (≈ $50 million). Over the next week the firm began collecting customer devices for forensic analysis, offered compensation, and sought assistance from government agencies. As of 27 October, a suspected threat actor posted data claimed to belong to GMO and its clients, though the authenticity is still under verification.

Separately, GMO’s cybersecurity unit linked a Chinese AI‑enabled penetration testing tool named Artex to a wave of intrusions across Japan and South Korea. CrowdStrike reported that Artex exploited weak controls such as missing multi‑factor authentication. The tool’s developer has since halted public updates and moved the codebase to closed source after the tool was tied to bank‑targeted attacks.

Why it matters for GPU and AI infrastructure

Cloud GPU platforms host high‑value workloads — model training, inference, and real‑time analytics — making them attractive targets for credential theft and ransomware. The GMO breach underscores the need for mandatory multi‑factor authentication, continuous vulnerability scanning, and hardened isolation between tenant workloads. Providers that integrate AI‑driven threat detection and enforce defense‑in‑depth architectures will reduce the blast radius of similar incidents and protect the compute assets that power modern AI pipelines.