The rough month for cybersecurity shows no signs of slowing down.
Japan’s GMO Internet Group’s representative and CEO Masatoshi Kumagai has issued a striking public warning after a cyberattack on one of his company’s cloud services spiralled into unauthorized trading on customer accounts at more than 70 brokerages worldwide. In a lengthy blog post published on October 25, Kumagai said the internet itself “is already starting to break down,” and used the incident to formally ask the Japanese government to invoke the country’s newly enacted active cyber defense law on GMO’s behalf.
What is the GMO Internet Group?
GMO Internet Group is one of Japan’s largest internet conglomerates, built around the idea of bundling internet infrastructure with financial services. Kumagai founded the company in 1991 and took it online in 1995 under the tagline “Internet for Everyone,” and it now operates across domain registration and web hosting (it runs Onamae.com, Japan’s largest domain registrar, along with cloud and hosting brands like ConoHa and Z.com), online advertising, internet banking, cryptocurrency exchange, cybersecurity, and FX and securities trading through subsidiaries such as GMO Click Securities, which has repeatedly ranked as the world’s highest-volume FX broker. The group now spans roughly 130 companies, 12 of them separately listed, employs close to 7,900 people on a consolidated basis, and posted consolidated revenue of about ¥285.3 billion (roughly $1.9 billion) for the 2025 fiscal year, with total group assets of just over ¥2 trillion — a market capitalization across its listed entities of around ¥1.5 trillion as of early 2026.
The GMO Internet Group Breach
The breach originated in “Onamae.com Desktop Cloud,” a Windows remote-desktop VPS service that GMO Internet operates and that is popular with retail FX traders for running automated, round-the-clock trading bots. GMO first disclosed the intrusion on October 21, saying attackers had planted malicious programs on customer server environments and that roughly 26,739 servers were potentially affected. Rather than simply stealing data, the attackers used their access to continue placing unauthorized trades on customer accounts connected to FX brokers and securities firms both in Japan and overseas, according to Kumagai’s post.
According to Kumagai, the attackers also threatened to leak the personal data found on compromised customers’ PCs, deploy ransomware against them, and publicly expose internal information about GMO’s own systems and operations if their demands weren’t met. GMO has pushed back on the idea that this is a niche problem limited to one VPS product, arguing that a service connecting to the financial infrastructure of more than 70 companies, and effectively holding both people’s savings and personal data hostage, is a matter of national concern rather than “one company’s trouble.”
GMO’s response: compensation and a free six-month lifeline
GMO has pledged to pay every affected customer a flat 5,000 yen condolence payment and said it will separately compensate, in full, any trading losses tied to the unauthorized access — even in cases where an exchange or broker declines to refund the loss itself. The company is also offering affected users six months of a free replacement hosting environment and says it will overhaul the underlying system architecture with outside security experts.
Kumagai used much of his post to admit that the breach wasn’t entirely unforeseeable. He wrote that GMO’s own in-house white-hat hackers had flagged security gaps in the service beforehand, and that the operating team was aware of the issue and working on it, but that the pace and depth of the response weren’t sufficient given competing priorities, leaving a gap the attackers were able to exploit.
Blaming AI-powered attack tools
The core of Kumagai’s warning is about how much cheaper and easier large-scale hacking has become thanks to AI. He said open-weight AI models are now being freely combined into attack tooling, turning what once required serious technical skill into something almost anyone can pull off. As a specific example, he said GMO Cybersecurity by Ierae’s own research found that ARTEX, an autonomous AI penetration-testing tool GMO built for defensive purposes, had been abused by attackers targeting roughly 20 Japanese companies. He described the current moment as a kind of “AI cyber-saturation attack,” where the sheer volume of AI-generated attacks is starting to overwhelm defenders’ ability to respond.
He pointed to the recent PHP vulnerability as evidence of this shift, noting that automated exploitation attempts went from a trickle to millions within hours of the flaw becoming public — severe enough that Japan’s prime minister and the FBI both issued public warnings about it, and that Cloudflare’s CEO described exploitation attempts jumping from thousands to millions within hours of disclosure. Many sites, he noted, had no option but to take themselves offline to avoid being swept up in the automated assault.
Kumagai’s post arrives in the same week that another single-vendor security lapse rattled markets far beyond its own customer base: a flaw in how Indian certificate authority eMudhra generated its signing keys forced internet companies worldwide to scramble, wiped out roughly 20% of eMudhra’s stock value in a single session, and was followed just days later by cloud platform Railway disclosing its own security breach that paused all customer deployments. Taken together with GMO’s breach, it’s been a rough month for the infrastructure layer that much of the internet quietly depends on.
Kumagai closed his post by framing the breach as a test case for Japan’s new cyber defense law and for public-private cooperation more broadly, saying he’s willing to stake the rest of his career on getting the response right. He urged engineers, business leaders and ordinary citizens not to dismiss the incident as somebody else’s problem, warning that without an effective defense framework in place, the next target could just as easily be anyone’s bank account or a company’s core systems.