GMO cloud breach puts trading accounts and customer data at risk
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Tuesday, October 27th, 2026.
Customers of GMO Internet’s cloud desktop service face possible data theft and unauthorized trading activity. The company shut down the service after discovering unauthorized access. It later said information linked to customers and its business appeared to have been published online. GMO warned that twenty six thousand seven hundred thirty nine virtual desktop servers may have been affected, while the attacker demanded about 8 billion yen, or roughly fifty dollars million.
The service hosted Windows desktops used for foreign exchange trading, so the breach carries direct financial consequences. Some customers reported transactions they didn’t recognize. The company also warned that trading sessions may stay active even after a password is changed.
For leaders, this is a reminder that slow action on known security improvements can turn technical debt into customer losses. For defenders, credentials, active sessions, devices, and trading accounts need separate containment steps. Hosted desktops can concentrate identity, endpoint, and transaction risk in one service.
Customers should reset trading credentials from a clean device, terminate all active sessions, and review their accounts for unauthorized transactions.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
