GMO Internet has promised current Onamae.com Desktop Cloud customers a ¥5,000 goodwill payment following the cyberattack on its hosted Windows service. Its fourth notice, issued 24 October, separately commits to compensating realised losses from unauthorised trades that its investigation attributes to the incident. The standard payment is not a ceiling on eligible trading-loss claims.[1]
Payments and service commitments
| Measure | Scope | Next stated date |
|---|---|---|
| Goodwill payment | ¥5,000 per current customer, irrespective of financial loss | Procedures and payment timing by 30 October, 23:59 JSTSource 1 |
| Trading-loss compensation | Attributed realised losses and associated charges, less broker/exchange refunds | Application requirements and payment timing by 6 NovemberSource 1 |
| Replacement hosting | Optional migration to independent cloud infrastructure; six months free | Availability, terms and non-migration arrangements by 30 October, 23:59 JSTSource 1 |
GMO says it confirmed unauthorised access and removal of information. Its earlier scope estimate covered 26,739 potentially affected servers across all service plans; that is not a verified count of compromised customer accounts. The company began suspending servers on 21 October after finding a malicious program on 20 October.[1][3]
Compensation depends on transaction and access records linking the trades to the incident. Ordinary market losses, hypothetical missed profits and indirect damage are excluded. Refunds from brokers or exchanges reduce the balance payable, while GMO says refusal by an intermediary does not itself prevent payment of an otherwise qualifying loss.[1]
Security steps in the fifth notice
| Action | Reason or qualification |
|---|---|
| Change trading credentials from an unaffected device | Avoid the affected trading environmentSource 2 |
| Terminate all active sessions, involving the broker where needed | A password change may leave existing sessions activeSource 2 |
| Check balances and history; enable available two-factor authentication | Identify unauthorised activity and strengthen access controlsSource 2 |
| Scan local devices and back up carefully | GMO is investigating possible effects beyond hosted serversSource 2 |
GMO will not simply restart the compromised infrastructure. Migration requires customer consent, with features and post-free-period charges disclosed first. For claims, the notice allows a specifically explained read-only history credential but says ordinary passwords or PINs will not be requested.[1]
Sources & further reading
- Onamae.com Desktop Cloud cyberattack — fourth report, goodwill and unauthorised trading compensation GMO Internet, Inc. · 24 Oct 2026 · Accessed 26 Oct 2026
- Desktop Cloud cybersecurity instructions — fifth report GMO Internet, Inc. · 24 Oct 2026 · Accessed 26 Oct 2026
- Onamae Desktop Cloud unauthorised access and trading accounts — second report GMO Internet, Inc. · 22 Oct 2026 · Accessed 26 Oct 2026