GMO Internet Group has cut the pay of four executives for three months after a cyberattack on its Onamae.com Desktop Cloud service exposed customer information and led to unauthorised trades in customers' investment accounts. Founder and group chief executive Masatoshi Kumagai will take a 30% cut, subsidiary president Tadashi Ito 25%, and senior officers Hirofumi Yamashita and Kimihiro Kodama 20% each, starting with December 2026 pay.

The cuts were announced at the company's first press conference on the incident on 2 November, where Kumagai apologised. He admitted that the group's own security unit, GMO Cyber Security by Ierae, had flagged a vulnerability in the trading-server service in April 2024, but the finding was judged resolved after temporary maintenance and was not acted on effectively.

Intrusion went unnoticed for months

According to Kyodo News, the attacker first entered a customer's server environment on 5 August and was only noticed on 20 October. Onamae.com Desktop Cloud rented out Windows servers that traders used to run MetaTrader programs around the clock; up to 26,739 servers may have been exposed, and brokers confirmed hackers used stolen logins to place trades on client accounts. GMO shut every server on the service on 21 October, and it remains offline.

GMO has refused to pay the attackers, who demanded money and threatened to publish customer data and launch ransomware. The company is offering a US$1 million bounty for information identifying the attackers, a ¥5,000 goodwill payment to every current user, and compensation for verified losses from unauthorised trades. It says it will revisit management accountability once it has verified how the breach happened, and has not announced a final determination of the cause or the full extent of the damage.

Sources: TipRanks; CoinSpectator.