The Day Financial Infrastructure Stops: A Japanese VPS Breach, Search Suggestions, Share Prices, and What Under-investing in Security Costs (Flash Edition)

A VPS service used to run automated FX trading went offline, and its users were asked to back up their data, unplug their PCs and power them off. On the first trading day after the operator confirmed that customer data had been taken (Notice No. 4, 24 October), the parent company's share price fell by more than 15%. This article records the sequence of events from public sources only, follows how search suggestions and share prices moved, and, separately from the still-unpublished cause of this incident, sets out what under-investing in security can cost any operator. This is a flash edition; the figures will be updated every business day (see the update history at the end). Press reports say that after the 27 October deadline the attacker published one item of what appears to be personal data and announced daily publications at noon (authenticity unknown; see section 1).

Also published on the author's blog nkzw.jp and Egosaru.

What happened (public information as of 16:00 JST, 28 October 2026)

The service is "Onamae.com Desktop Cloud", a Windows VPS offered by GMO Internet, Inc. for running MT4/MT5 expert advisors (automated FX trading) around the clock. Up to 26,739 servers may be affected. The timeline below is limited to what the company has published and what has been reported. The cause (the intrusion route) has not been officially disclosed as of 28 October.

Notes:

• The amount demanded is reported differently: USD 50 million (about 8 billion yen) according to Kumagai's blog and the company, and USD 1 million (about 160 million yen) in the deadline notice on the attacker's site. The initial demand and a later deadline demand may differ. This article lists both with their sources and goes no further.
• Claims about the intrusion route or internal configuration contained in the statement of the party claiming to be the attacker are not covered here, because they are not published facts. The name of the attacker group is not given either, as it has not been confirmed by multiple outlets.
• The Minister for Financial Services has said that five FX firms reported customer losses believed to be related to this case (press reports). The firms and the individual users are not identified in this article.

I captured the site's DNS records, TLS certificate, HTTP headers and the screen of every page on 27 October 2026 and keep them together with a list of SHA-256 hashes (45 files in total). They are held for submission to the authorities and will not be published in this or any future article. The image below is the top page at the time of capture, fully redacted; it shows only that the record exists. The registration and suspension of the domains are recorded in the table above (the row for 28 Oct, 03:35-03:36). How to read that record (why it was the registrar that stopped the site) and my view as someone in the domain business are set out in a separate article, How the Attacker's Site Was Taken Down: The clientHold Timestamp in WHOIS, and a View from the Domain Business.

Top page of the site of the party claiming to be the attacker (captured 27 Oct 2026). All text, images and names are redacted

Why this is existential for users

Automated FX trading keeps open positions around the clock. If the VPS stops, users can neither close positions nor adjust them, and any market move turns into a realized loss. That is the first thing users faced in this incident. The company explains the shutdown as a measure to contain the damage, but at that moment users are left unable to trade.

Next came the request to back up data, unplug the PC and power it off. For many people the PC connected to the service is also a tool for work and daily life. Being asked to switch it off means stopping part of one's business or life, not just trading. Reports also describe employees visiting customers' homes to take custody of devices. For the user, that means the PC leaves their hands.

The announced payment and compensation matter, but Notice No. 4 limits compensation to realized losses from unauthorized trades (trading losses and fees); losses from market moves and lost profits are excluded. The opportunity cost of positions that could not be managed, and the business downtime while the PC is off, fall outside that scope.

This is not specific to this case. In general, part of the cost of a breach is paid by users, in time and lost opportunity. Where prior investment fell short, users end up paying the difference.

Search suggestions

Search suggestions reflect what people are worried enough to search for. Using Egosaru (gstudio1.com, a bulk Google-suggestion collection tool), I am collecting the phrases that follow each GMO group brand name twice a day from 27 October. The question is which words ("unauthorized access", "data leak", "compensation", "cancel", "is it safe") attach to which brand names, and in what order.

Figure 1. Incident-related suggestion counts, Google Trends, and relative share prices of 9449 and 7177 (23 Oct = 100)

As of this flash edition there is only the first collection run, 12:17–12:40 JST on 27 October (the baseline). In that run of Google suggestions (Japanese), incident-specific words were attached to the following brands:

• "GMO Internet Group": "unauthorized access", "data leak", "share price fall reason"
• "GMO Internet": "unauthorized access", "leak", "share price fall"
• "Onamae.com": "ransomware", "dangerous", "is it safe"
• "GMO Click Securities": "unauthorized access", "full compensation", "is it safe"
• "GMO Payment Gateway" and "GMO GlobalSign": "leak", "share price fall reason"
• "ConoHa": "unauthorized access"

The name of the affected service itself ("Onamae.com Desktop Cloud") had only 28 candidates and no incident-specific words. Meanwhile, group services not directly involved, such as GMO Click Securities, GMO Payment Gateway, GMO GlobalSign and ConoHa, carried "unauthorized access", "leak" or "share price fall". Whether those words were already attached before the incident cannot be judged from this baseline alone: for "GMO Coin" and "GMO Aozora Net Bank", collected ahead of time on 24–25 October, "unauthorized access", "data leak" and "dangerous" were already attached before the disclosure and were unchanged on 27 October. An "unauthorized access" suggestion therefore does not, by itself, mean an effect of this incident. Because the incident-word count (top panel of Figure 1) also includes everyday words such as "login" and "cancel", read it as a change from the baseline, not as an absolute level. Two things are being watched:

1. The incident concerns a single service, "Onamae.com Desktop Cloud". Do anxiety words spread to "Onamae.com" as a whole, and then to the group name "GMO"?
2. Do "is it safe" and "cancel" attach to unrelated group services (hosting, domains, payments, securities)? If so, anxiety words have spread beyond the scope of the incident to other services in the group (this is an indicator of attention, not an evaluation).

3-1. Breakdown of the collection run (Figure 2; run of 28 Oct, 09:00)

Figure 2. Breakdown of incident-word suggestions by brand and by word (run of 28 Oct, 09:00)

Aggregating the run of 28 October, 09:00 (Google, Japanese, plain brand-name seeds): of 6,685 candidates across 18 brands, 179 (2.7%) contained an incident word. By word: "share price" 64 (7 brands), "cancel" 58 (12 brands), "outage" 25 (10 brands), "refund" 9, "cannot log in" 6, "unauthorized access" 6 (6 brands), "data leak" 3, "is it safe" 3, "dangerous" 2, "switch provider" 2, "compensation" 1 and "ransomware" 1 (a candidate containing two words is counted under each; the stacked bars on the left of Figure 2 assign each candidate to one category, so they sum to 179). The first run (27 Oct, 12:17) had 6,701 candidates and 177 incident-word candidates; the difference is "Muumuu Domain unauthorized access" and additional cancellation-related candidates for "Onamae.com".

Three points on how to read it. First, the most frequent word, "share price", is attached to the names of the listed companies, led by GMO Internet (29), and reflects attention drawn by the share-price fall itself. Second, "cancel" and "outage" are everyday words for hosting and domain brands (ConoHa, Lolipop, Muumuu Domain, Onamae.com), and this baseline alone cannot separate them from any effect of the incident. Third, incident-specific words (unauthorized access, data leak, ransomware, compensation, is it safe, dangerous) total 16, just under a tenth of the whole, and none is attached to the name of the affected service itself ("Onamae.com Desktop Cloud"). The highest shares of incident-word candidates are GMO Internet (6.2%) and GMO Financial Holdings (6.0%), both driven by "share price". This breakdown is the baseline against which later runs will be read: how the count and the number of brands for incident-specific words move.

The second collection run, at 21:00 on 27 October (961 jobs, no failures), returned Google suggestions (Japanese) almost identical to the first (12:17). The brands carrying incident-specific words, and the words themselves, did not change; the only additions were one suggestion, "Muumuu Domain unauthorized access", and some cancellation-related candidates for "Onamae.com" ("server service cancel", "net de diagnosis cancel", "cancel domain"). The third run, at 09:00 on 28 October (961 jobs, no failures), was identical to the 21:00 run: incident-word candidates stayed at 179. Even across the attacker's publication (27 Oct, afternoon) and the takedown of the attacker's site (early 28 Oct), the next morning's suggestions did not move. Figure 2 is redrawn from the 28 October 09:00 run, and the diamonds in Figure 1 show the same values.

In the Google Trends panel of Figure 1 (Japan; relative values with the 90-day maximum set to 100; the 90 days are re-fetched at every update, so the scale changes each time), search interest in "GMO Internet" rose after the 24 October disclosure, peaked on the deadline day, 27 October, and roughly halved on 28 October; "Onamae.com" rose on 26–27 October and fell on 28 October. Lolipop shows a separate peak on 22 October, before the disclosure; no relation to this incident can be confirmed.

Suggestions indicate attention, not facts. A "cancel" suggestion does not mean cancellations increased. This caveat will be repeated every time the chart is updated.

Share prices

Sources: Yahoo! Finance Japan (daily data for each stock, checked after the close on 2026-10-28). On 27 October, 9449 recovered in the morning, fell to a low of 3,040 yen in the afternoon and closed at 3,159 yen (−0.63% on the day). On 28 October, after the takedown of the attacker's site became known, 9449 rebounded 165 yen (5.2%) to 3,324 yen, and 7177 and 4784 also rose, but none has returned to its 23 October level. The Nikkei 225 is 2.0% above 23 October.

Figure 3. Change in market capitalization of listed group companies vs 23 Oct

On the 28 October close, the market capitalization of 9449 was down about 41.4 billion yen (11.8%) from 23 October, 7177 about 5.8 billion yen (4.3%), 4784 (GMO Internet) about 20.7 billion yen (13.8%) and 3769 (GMO Payment Gateway) about 12.5 billion yen (1.9%) (shares outstanding from Yahoo Finance; treasury shares not taken into account). The simple total for eight listed group companies (9449, 7177, 3769, 3633, 3788, 4051, 6180, 4784) is about 84.5 billion yen (6.0%) down, or about 63.8 billion yen (5.1%) excluding 4784. Compared with the 27 October close (eight companies about 126.1 billion yen, 9.0% down), the 28 October rebound reduced the decline to about two-thirds. Market capitalizations of the parent (9449) and listed subsidiaries (such as 4784) overlap, so the total is not adjusted for ownership. Figure 3 uses the same close-based values (3695 is excluded because its company name could not be confirmed).

That the parent company's share price fell 15.7% from 23 October on the first trading day after Notice No. 4, closed 16.2% below that level again on 27 October, and was still 11.8% below it after the 28 October rebound, is a matter of public record. The figure includes the movement of the market as a whole and does not isolate the effect of the incident. Selling also reached the holding company of the group's FX businesses (7177); the reason cannot be confirmed from public information.

A rough calculation of the flat payment from public figures only: 5,000 yen multiplied by the 26,739 potentially affected servers, as an upper bound, is about 134 million yen. The value lost in the share price decline is of a different order. The point is not that the compensation is small. In general, the cost of a breach can show up far more in lost enterprise value than in the compensation paid.

This article is not investment advice. Share prices are treated as a record of what happened; no trading recommendation or forecast is made.

In general: what happens when security investment is deferred

The rest of this section leaves the present case and sets out what past cases and existing rules say in general. The cause of the present case has not been disclosed, and nothing below is applied to it.

Figure 4. General pattern: how deferred security investment can cascade (not a description of any specific incident)

5-1. A change in trust shows up in search behaviour within days

In past incidents, anxiety words attached to brand searches within days of disclosure, changing the character of searches for the brand. For this case, section 3 will track the data and this article will be updated when it is available.

5-2. The size of what comes after

• Benesse (Japan, 2014): After a leak of customer data, the company booked an extraordinary loss of 26 billion yen (20 billion yen for compensation and 6 billion yen for investigation and countermeasures) and posted a net loss for April–June 2014. The vice chairman and the CIO resigned (source: ScanNetSecurity, 2014-08-01, https://scan.netsecurity.ne.jp/article/2014/08/01/34611.html; and 2015-02-10).
• Equifax (US, 2017): Data on about 147 million people was exposed. In 2019 the company agreed to a global settlement with the FTC, the CFPB and 50 states and territories of at least USD 575 million and up to USD 700 million (source: FTC press release, 2019-07-22, https://www.ftc.gov/news-events/news/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related-2017-data-breach).
• Colonial Pipeline (US, 2021): Ransomware halted the fuel pipeline serving the US East Coast. The CEO testified before the Senate that the company had paid a ransom worth about USD 4.4 million (source: AP, 2021-06-08, https://www.bangordailynews.com/2021/06/08/nation/pipeline-ceo-defends-paying-ransom-amid-cyberattack/).

The amounts incurred after the fact are as above. A comparison with the cost of prior countermeasures cannot be made from public information, but the size of the after-the-fact amounts is common to all three.

5-3. Shareholder litigation and directors' responsibility

In Japan, directors owe a duty of care under Article 423 of the Companies Act, and the Ministry of Economy, Trade and Industry's Cybersecurity Management Guidelines call for the board to oversee cybersecurity as a management issue. The Financial Services Agency's supervisory guidelines likewise treat system-risk management as a responsibility of senior management. In the US, the SEC introduced disclosure rules for material cyber incidents in 2023. In Japan and abroad, cybersecurity is positioned as a matter for the board, not only for the technical department.

5-4. Constraints on users, and their unfairness

Even when compensation arrives, the lost opportunity of positions that could not be managed does not come back. A request to "please switch off your PC" is one form of the price users pay, in time and opportunity, when the cost of countermeasures is deferred. That social cost does not appear on the operator's income statement.

What operators and executives can do now (general; based on public guidelines)

1. Put a reporting line for cyber risk into the board. Each quarter, the board receives the list of open findings and the reasoning behind their priority.
2. Give security findings a deadline. For findings from internal or external specialists, decide not "whether" but "by when, and to what depth"; findings past their deadline go on the agenda of the management meeting.
3. Check the basics. Separation of privileged accounts and multi-factor authentication, restriction of remote-access routes, reliable deletion of environments and credentials after use ends, isolated backups, log monitoring. All of these appear in METI and IPA guidelines and apply to any operator.
4. Design user communication for incidents in advance. Decide what to tell users, when, and through which channel. When asking users to act, attach an explanation that matches the burden being asked of them.
5. Check how your site looks from the outside. The versions and security headers a server announces can be checked by anyone. In my "Security Exposure Survey 2026" (https://sitescouter.net/en/articles/security-exposure-statistics-2026), Japanese sites ranked last among 10 regions on all eight security controls.

Limits and caveats

• This article is based only on public information (GMO's notices, Kumagai's blog, press reports, share prices, search suggestions). The intrusion route and cause await the official investigation report.
• Claims made by the party claiming to be the attacker are unverified and are not treated as facts here.
• Search suggestions indicate attention, not facts or cancellation numbers.
• Share prices include the effect of the overall market and do not isolate the incident.
• The affected FX firms and individual users are not identified.

Closing: put someone in charge who answers for the outcome

In his blog post of 25 October, Kumagai explained that internal white-hat hackers had flagged improvement items in advance, that the operations team had weighed availability and other priorities, and that the depth and speed of the response were insufficient (source: https://www.kumagai.com/?eid=19600). The structure in which security findings compete for priority with availability, revenue and deadlines exists at every operator. The price of that judgement grows with the time between the finding and the fix.

As a general matter, what is missing is not findings. It is an executive who takes the findings on board, decides the priority between availability and safety, and answers for the result. Listed companies need an executive responsible for information systems (a CIO) and an executive responsible for security (a CISO), so that it is clear who answers for the outcome. My superior has long proposed this; the present case shows why it is needed. Without such executives, the same pattern will repeat at any listed company.

Appendix: Primary sources, as captured on 27 October 2026

Published pages are sometimes revised, moved or removed later, so full-page screenshots of the primary sources this article relies on were saved as displayed on 27 October 2026. The source URL and capture date are given above each image. The pages are in Japanese.

Primary source 1. GMO Internet Group, Report 2 (published 22 Oct 2026)

Source: https://group.gmo/info/alert/20261022/ / Captured: 27 Oct 2026

Primary source 2. GMO Internet Group, Report 4 (published 24 Oct 2026)

Source: https://group.gmo/info/alert/20261024/ / Captured: 27 Oct 2026

Primary source 3. GMO Internet Group, notice (published 25 Oct 2026)

Source: https://group.gmo/info/alert/20261025/ / Captured: 27 Oct 2026

Primary source 4. Onamae.com, Report 1 (published 21 Oct 2026)

Source: https://www.onamae.com/news/article/11584 / Captured: 27 Oct 2026

Primary source 5. Masatoshi Kumagai's blog (published 25 Oct 2026)

Source: https://www.kumagai.com/?eid=19600 / Captured: 27 Oct 2026

Disclosure

The author was previously at a GMO group subsidiary and held shares in the group at one time, but currently has no relationship with the group and holds no shares. The author is, however, a current customer of ConoHa VPS, a GMO group service. It is a different service from the one affected, and no impact on ConoHa has been announced, but as someone whose work runs on the same group's infrastructure, the author is not free of concern. This article is based solely on public information, and no information obtained during that employment has been used. It is not investment advice but part of the author's effort to share information about security.

Update history

• 2026-10-27 Flash edition (timeline as of 13:00 JST on 27 Oct; share prices and Figures 1 and 3 through the 27 Oct close; search-suggestion baseline only)
• 2026-10-28, 16:00 JST: day-2 update (section 1 adds Notices No. 9, 11, 12 and 13, the takedown of the attacker's site early on 28 Oct, the bounty and special condolence payments, and the 28 Oct rebound; share-price table and Figures 1 and 3 updated to the 28 Oct close; Figure 2 redrawn from the 28 Oct 09:00 run; Google Trends re-fetched for 90 days)
• 2026-10-29: section 1 adds the registration dates, registrar and clientHold timestamps of the two attacker-site domains (coronamng.store and designbuilder.store), as confirmed from the .store registry WHOIS / RDAP
• 2026-10-29: the end of section 1 adds the fully redacted top page of the attacker's site and a note on the preserved record (45 files with SHA-256 hashes, not published)
• 2026-10-29: the end of section 1 adds a reference to the separate article "How the Attacker's Site Was Taken Down"

References

Last checked: 2026-10-28. Specifications and policies can change; check the primary sources before acting.

• GMO Internet Group, Notice No. 2 (22 Oct 2026)
• GMO Internet Group, Notice No. 4 (24 Oct 2026)
• GMO Internet Group, notice (25 Oct 2026)
• GMO Internet Group, Notice No. 13 (28 Oct 2026)
• Onamae.com, Notice No. 1 (21 Oct 2026)
• Masatoshi Kumagai's blog (25 Oct 2026)
• Egosaru (search suggestion tool)