ABAB News Logo
Back to Flash News

Japan hit by multiple hacks; GMO had data exposed after being extorted for about $50 million

In October 2026, several Japanese companies and institutions successively disclosed cyberattacks and data breaches. Onamae Desktop Cloud, a cloud desktop service for foreign exchange automated trading under GMO Internet, suffered unauthorized access. The company said about 26,739 servers may have been affected, and the attacker demanded a cryptocurrency ransom of about 8 billion yen (about $50 million). GMO refused to pay. The attacker then publicly released what appeared to be customer information. The company has reported the case to the police and urged customers to disconnect their devices. The Tokyo Metropolitan Police Department has joined the investigation.

Other cases disclosed around the same time include: IDC Frontier's cloud services were hit by ransomware, affecting about 495 companies and local governments; Times Car's car-sharing service had data from about 6.6 million member accounts leaked; Yakiniku King's app had about 10.79 million member records leaked; Ymirlink's email service may have exposed about 51.6 million personal records; and records related to Sagawa Express reached as many as about 53.23 million entries. Many of the incidents entered through contractors, cloud platforms, or application vulnerabilities.

Japanese Prime Minister Sanae Takaichi instructed the cabinet on October 26 to draw up an emergency cybersecurity countermeasure package before the end of next week, and said she would consider response options including neutralization measures. GMO has asked the government to take proactive cyber defense measures. Many of the cases are still under investigation, and some companies have announced compensation plans.

Original sources:

  1. Title: Japan internet giant GMO says hackers posted stolen customer data Publisher: TechCrunch Date: 2026-10-27 URL: https://techcrunch.com/2026/10/27/japan-internet-giant-gmo-says-hackers-posted-stolen-customer-data/ Nature of source: media report Verification status: main content of the full text was read this time (2026-10-28) Supported content: GMO Onamae Desktop Cloud suffered unauthorized access; about 27,000 servers may have been affected; a ransom demand of about 8 billion yen (about $50 million) was received; the attacker made related suspected information public; the service was shut down

  2. Title: Japan to compile emergency cybersecurity package by next week: Takaichi Publisher: Kyodo News Date: 2026-10-26 URL: https://english.kyodonews.net/articles/-/89418 Nature of source: media report Verification status: full page content was read this time (2026-10-28) Supported content: Prime Minister Takaichi instructed that an emergency cybersecurity countermeasure be prepared before the end of next week; a series of attacks was mentioned as causing multiple incidents; GMO requested proactive cyber defense; Ymirlink may have exposed about 51.6 million records; Rakuten's subsidiary may have exposed about 2.6 million records

  3. Title: Japan Data Leak Wave Exposes Blind Faith in Contractors, Security Expert Warns Publisher: Japan Forward Date: 2026-10-28 URL: https://japan-forward.com/data-breaches-contractors-security-expert/ Nature of source: media report Verification status: main content was read this time (2026-10-28) Supported content: Times Car had about 6.6 million accounts; IDC Frontier affected 495 organizations; NEC entered multiple customer systems through subcontractor credentials; multiple contractor-related leaks

  4. Title: Japan's GMO urges customers to shut down PCs amid ransomware threat Publisher: BleepingComputer Date: 2026-10-27 URL: https://www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/ Nature of source: media report Verification status: main content was read this time (2026-10-28) Supported content: GMO advised customers to disconnect and shut down their computers; about 26,739 servers may have been affected; the ransom demand was about 8 billion yen; the attackers threatened to publish data and launch ransomware

ABAB AI Insight

In autumn 2026, Japan saw a concentrated wave of cyberattack and data breach disclosures. The public cases show that attack paths often entered through contractor systems, cloud services, application backends, or known vulnerabilities, and that one vendor breach can affect multiple clients at once. The IDC Frontier cloud platform ransomware incident affected about 495 organizations, including railways and local governments; several financial, logistics, restaurant, and email service companies also separately reported millions of records exposed. The GMO Onamae Desktop Cloud incident directly involved unauthorized manipulation of trading accounts and a high ransom demand.

On the capital and responsibility side, companies refused to pay ransoms (GMO clearly said it would not pay the roughly $50 million demand) while launching compensation measures and police investigations. Prime Minister Takaichi instructed the drafting of an emergency countermeasure package and mentioned response options including neutralization measures. Japan already has a legal framework for proactive cyber defense, but private companies' requests for government involvement remain limited in scope. Many of the cases show contractors and cloud providers becoming concentrated risk points, and companies' assumptions about upstream security being broken by successive incidents.

Compared with single-point incidents, this wave is characterized by multiple institutions disclosing independently or in connection over a short period, and it involves trading systems, logistics data, and large-scale personal records. Historically, ransomware and supply chain attacks have had precedents in many countries, and Japan's recent cases have clustered in financial trading cloud, courier, ridesharing, and email services. The government's preparation of an emergency plan reflects a policy response to successive incidents rather than to a single company.

These incidents have changed the visible cost of Japanese institutions' assumptions about contractor and cloud service security. For the market, observable indicators include the specific content of the emergency countermeasure package, whether more companies make additional disclosures, and progress on compensation and investigations. The scale of the data exposure and the manipulation of trading accounts have pushed some cases beyond simple information leakage and into actual funds and business interruption.

ABAB News · Laws of Cognition

  1. Once a vendor is breached, multiple clients may be exposed to data leaks or service disruptions at the same time.

  2. After refusing to pay a high ransom, attackers may still publicly release data and continue to apply pressure.

  3. Successive disclosures push the government from case-by-case response toward drafting an emergency countermeasure package.