What happened. GMO Internet runs Onamae Desktop Cloud, a hosted Windows desktop service in Japan. BleepingComputer notes it was marketed as ideal for nonstop automated FX trading on MetaTrader 4. GMO says customer inquiries on Oct. 19 started its investigation. On Oct. 20 it confirmed malicious programs had been installed and shut the control panel. At 4:00 a.m. on Oct. 21 it began shutting down servers on every plan. Up to 26,739 customer servers may have had malware installed, per BleepingComputer.
Then it turned into extortion. GMO says it got a threatening email on Oct. 21 demanding about ¥8 billion, roughly $50 million per BleepingComputer. GMO refused. It’s paying every current customer ¥5,000 (about $30) and says it will cover realized losses from unauthorized trades. On Oct. 27 it told customers to back up, disconnect and unplug their own PCs before a noon deadline the attacker set for leaks and ransomware. GMO later confirmed company and customer data had been published. As of its Oct. 27 update, no malware had turned up on the customer devices it had finished analyzing, and BleepingComputer reports no ransomware was triggered.
The part that matters. Read GMO’s Oct. 24 report closely. The attacker’s threats included continued unauthorized operation of customer trading accounts at more than 70 securities and FX firms in Japan and abroad. Customers had already reported trades they didn’t make. That’s the real target. Not the servers. The sessions.
An always-on trading desktop is a box that stays logged in to a broker 24 hours a day, with saved credentials and a bot ready to place orders. Compromise the host and you don’t need to phish anyone. You inherit every live session on it. GMO’s own emergency steps say as much: it asked exchanges and brokers to block access coming from the service and force-disconnect all active sessions.
Your company has this fleet too. It just goes by other names. RPA bots, the software robots that click through finance and HR apps. Jump boxes admins use to reach production. Shared virtual desktops for contractors. And now the virtual machines AI agents run in, signed in to SaaS apps so they can act on their own. Each is a machine whose whole job is to stay signed in to something valuable. Each often runs on a provider whose management plane can touch all of them at once.
That’s the lesson. One intrusion at the provider reached up to 26,739 customer machines. The customer’s own settings on each desktop didn’t decide the outcome. The provider’s admin plane did.
What GMO got right. Two things stand out. First, it refused to pay and explained why: paying doesn’t guarantee the stolen data gets deleted or stays unused. Second, it decided not to restart the breached platform as it was. Customers who still want a Windows desktop are being offered a replacement service on a separate cloud platform, free for six months. Rebuilding beats reopening.
It also did something unusual. GMO asked Japanese government agencies to treat the case as the first use of Active Cyber Defense, the framework under which the state identifies and neutralizes attacker infrastructure before damage spreads. Whether the government acts on that is an open question.
What to do this week. List every always-on machine that holds a live session into money, payroll, production or customer data. For each one, ask three questions. Does the session expire, or does it live forever? Is the credential stored on the box, or fetched just in time and thrown away? And if the hosting provider gets breached, can you kill every session from your side in minutes, without waiting on the vendor? GMO’s customers had to wait for brokers to cut the cord. Don’t build that dependency.
The bottom line. Security budgets go to protecting the people who log in. The bigger risk is the machines that never log out.