Products Lemma APIProof issuance & verification platformTrust402Delegate to agents, and transactSealSign-in for the agent era — no keys handed over
Use cases Manufacturing & Critical InfraInspection Record AssuranceFinance & FinTechCounterparty Record VerificationPublic SectorCertificate-less ProceduresHealthcareQualified Worker AssuranceProcurement & Supply ChainSupplier Credential MonitoringMedia & ContentContent AuthenticityService & RetailCross-group IdentityAI Adoption (cross-industry)AI Run GovernanceDevelopers & Agent OpsAgent Authority Control ▸ Browse the use-case index
Pricing
Resources Critical BriefThe frontier of AI × trustBlogThinking and implementation notesDocumentationAPI & specsVerification CenterReal verification & issuance countsAbout usFRAME00, Inc.ContactSales & press inquiriesGlossaryDefinitionsFAQFrequently asked questions
Dashboard ↗ JA
Home / Critical Brief / No. 165
No. 165 Critical Brief · Regulatory Attribute Proof

Onamae.com Desktop Cloud: Malicious programs were placed on rented servers, and customers reported trades they did not make

26,739
Servers potentially affected (all plans). Not the number where unauthorised access or data retrieval was confirmed
About ¥8billion
Amount demanded in the extortion email. The company says it will not pay
Undisclosed
Number and value of the trades customers say they did not make, and the intrusion route
CountryJapan
Incident date2026-10-20
Published2026-11-02
AuthorsLemma Critical Team
Contents
  1. 01Summary
  2. 02What got through
  3. 03Pre-execution check
  4. 04What Lemma does
  5. 05Facts and timeline
  6. 06Sources

Summary

Onamae.com Desktop Cloud is used to keep FX and other trading tools running, and the tools store trading-account logins. GMO Internet has confirmed unauthorised access to the service environment and the exfiltration of customer information, and since 21 October it has received reports from customers of trades they did not make. Those believed to be the attackers threaten to keep draining account balances with unauthorised orders. If a valid login is enough for an order to go through, then once the environment storing that login is entered, the order cannot be told apart from the holder’s own.

Exhibit 1Detection vs pre-execution check

A pre-execution check means checking, before an order or withdrawal is executed, that it is within the scope the holder set or approved by the holder, and keeping a record. Detection means noticing an intrusion after it happens.

Pre-execution check · not known from the disclosuresCheck the holder's scope and approval before execution
In betweenWhether orders before discovery
could be told apart is not known
Detection · workedInvestigate after inquiries and shut down all servers
Timing undisclosed
Customer information taken out
Reported from 10-21
Trades customers did not make
10-20
Malicious programs confirmed
10-21
All servers shut down

What got through

What got through
Trades that some customers say they did not make, on their trading accounts (reports from customers since 21 October). The number, value and timing have not been disclosed. The company’s compensation covers trading losses and fees (fourth notice).
What reaches the receiving side
In general, a trading tool connects to the securities or FX firm with the stored account login, and its orders arrive as operations made with a valid login. The company says the stored logins may have been obtained and misused (second notice).
Not disclosed
The intrusion route, how the trades customers did not make were carried out, and how the securities and FX firms authenticate.

Pre-execution check

Whatever the route, the condition for telling them apart is that the side receiving orders checks, before execution and separately from the login, the scope the account holder set and the holder’s approval.

The core of this case
A valid login is not proof that the account holder made the operation.
Who sets the scope and approves
The account holder. With a key on a device outside the trading tool’s environment (such as their own smartphone), the holder sets the scope delegated to the tool (instruments, size, daily limit, expiry, no withdrawals), and approves each order beyond that scope and each withdrawal or change of withdrawal destination. When the tool trades automatically, approval is not required order by order, and orders within the scope go through.
Where it is checked
The securities or FX firm’s servers that execute orders and withdrawals. Operations that do not match the scope or an approval are held, not executed.
What is left
A record of which scope and which approval each trade was executed under. It stays outside the compromised environment and can be used to recognise unauthorised trades and reconcile compensation.

Shutting down all servers and asking securities and FX firms to block access were measures taken after discovery. Whether orders placed before discovery could be told apart on the receiving side is not known from the disclosures. That valid credentials can be misused is a point shared with the Klue case (Salesforce data was extracted, starting from a test credential that had not expired).

What Lemma does

Lemma builds the pre-execution check into the side that executes orders and withdrawals. It does not look for intrusions; it checks whether an incoming operation is within the scope the holder set, or approved by the holder.

Industries and operations to watch

IndustryFinance
Securities, FX and crypto firms that take orders from trading tools or APIs. When a tool arrives with a valid login, it looks the same as the holder.
IndustryIT services (providers)
Businesses that host and run customers’ trading tools, such as FX VPS and desktop cloud providers. Many customers’ trading-account logins gather in their environment.
UsersFirms and individuals running trading tools in outside environments
Account logins are stored inside rented servers or cloud environments.
OperationAccounts & permissions
Managing trading-account logins, sessions, withdrawal destinations and two-step verification settings.

Current controls vs Lemma

What has been disclosed is trades on trading accounts that customers did not make; withdrawals and changes of withdrawal destination do not appear in the disclosures. Which column this route corresponds to has not been disclosed either, so the table sets out all three columns as a general comparison.

ControlWithdrawals and destination changesOrders beyond the scopeOrders within the scope
Strong passwords, regular changesNot effectiveNot effectiveNot effective
Two-step verificationPartialNot effectiveNot effective
Blocking and monitoring by securities and FX firmsPartialPartialPartial
Compensation for lossesNot relevantNot relevantNot relevant
Lemma (pre-execution check)EffectiveEffectiveNot effective

This compares what happens once a login is stolen. A password lets the operation through as soon as it is stolen; two-step verification looks only at login; blocking and monitoring look for unusual behaviour. Lemma checks the operation itself rather than the login.

Note: Lemma’s check works only where the securities or FX firm builds it in before executing orders and withdrawals, and the holder’s key is outside the trading tool’s environment. Orders within an automated-trading scope go through, as do operations when the approving device itself is taken over. The table compares what each control checks; it does not show whether anything would have stopped this case. Lemma does not detect or prevent intrusion or data exfiltration.

CheckChecklist

Three points for businesses that host trading tools and for securities and FX firms that accept trading accounts

  • When a withdrawal destination or authentication setting changes, does a notice also reach a contact outside the trading tool’s environment?
  • When an outside environment hosting a trading tool is compromised, can logins and sessions from that environment be stopped at once?
  • When an unauthorised trade is reported, can you provide the connection source and approval record for each trade to check compensation?

Facts and timeline

Service
Onamae.com Desktop Cloud (GMO Internet). A service for renting Windows desktops on the provider’s infrastructure.
Confirmed
The company has confirmed a security problem in the service’s system, unauthorised access to the service environment and the exfiltration of customer information (fourth notice). Malicious programs were placed in some customers’ server environments. Analysis of devices received from customers has so far found no trace of malware infection or ransomware (fourteenth notice).
Information that may have been misused
Information on the servers, including trading-account logins stored in trading tools. The company says payment data such as card details was not held on these servers.
Servers potentially affected
26,739 (all plans, second notice).
Extortion
About ¥8 billion was demanded in an email on 21 October. The threats include continued unauthorised operation (draining balances with unauthorised orders) of customers’ accounts at more than 70 securities and FX firms in Japan and abroad. The number is a claim by those believed to be the attackers.

Timeline

  • Investigation begins after customer inquiries.
  • Malicious programs confirmed in some customers’ server environments. New sign-ups and the control panel suspended.
  • Servers on all plans shut down from 04:00; first notice. Extortion email received the same day. From this day, reports of trades customers did not make are received.
  • Police consulted. 26,739 potentially affected servers disclosed.
  • Fourth notice says the security problem and the exfiltration have been confirmed. Payments to customers and compensation for losses from unauthorised trades decided.
  • Publication by those believed to be the attackers of material claimed to be company and customer information confirmed. A bounty (up to US$1 million) announced in the twelfth notice (as of 19:10); submissions from 12:00 on the 28th.
  • Dedicated bounty site opened at 12:00 (fourteenth and fifteenth notices). The bounty was also announced in the same day’s timely disclosure.
  • Sixteenth notice. Bounty tip counts begin to be published as weekday 18:00 addenda (428 in total as of 18:00 on the 30th).
  • Instructions on payments and the replacement service start going to customers.

Facts rest on GMO Internet and GMO Internet Group’s official statements (up to the sixteenth notice and the 30 October notice to customers). What has not been disclosed does not mean no measure existed. As of 2 November, no later notice has disclosed the intrusion route.

After disclosure

  • Requests to securities and FX firms: Major exchanges and brokers were asked to block access via the service, cut all sessions and monitor unauthorised trades.
  • Compensation: ¥5,000 to every customer currently using the service, whether or not they suffered a financial loss. Customers whose information the company confirms was in published material receive an extra ¥10,000–25,000 per category (cap ¥3 million per publication). Realised losses from trades the company recognises as unauthorised are compensated. The replacement service is free for six months. The current system will not simply be restarted.

Sources

  1. Primary, company noticeGMO Internet Fourth notice on the cyberattack against Onamae.com Desktop Cloud2026-10-24, Japanese; security problem and exfiltration confirmed · internet.gmo/news/article/249
  2. Primary, company noticesGMO Internet Current response to the unauthorised access, notices 7, 10 and 122026-10-26 – 27, Japanese · internet.gmo/news/article/253 / internet.gmo/news/article/256 / internet.gmo/news/article/258
  3. Primary, company noticesGMO Internet Same, notices 13 to 162026-10-28 – 30, Japanese · internet.gmo/news/article/259 / internet.gmo/news/article/260 / internet.gmo/news/article/261 / internet.gmo/news/article/262
  4. Primary, company noticeGMO Internet Notice to customers on payments and the replacement service2026-10-30, Japanese · internet.gmo/news/article/263
  5. Primary, company noticeGMO Internet Group Second notice and apology2026-10-22, Japanese · group.gmo/info/alert/20261022
  6. Primary, timely disclosureGMO Internet Group Unauthorised access to a consolidated subsidiary’s service2026-10-23, Japanese · ir.group.gmo/pdf/irlibrary/gmo_disclose_info20261023.pdf
  7. Primary, timely disclosureGMO Internet Payments and compensation for losses from unauthorised trades2026-10-24, Japanese · internet.gmo/ir/…
  8. Primary, timely disclosureGMO Internet Response policy2026-10-28, Japanese · internet.gmo/ir/…
1 more (reporting, analysis)
  1. PressMLex “Japan’s GMO Internet offers compensation after cyberattack”2026-10-24 · mlex.com/mlex/articles/2542176

References: “The last layer left in AI-era cyber defense”

The same method elsewhereSee all 14 "Account takeover" cases

This Brief sets out, from disclosed facts, what organisations in a similar position can check. It is not guidance on individual losses or procedures.

This material is a structured analysis of public information; it is not an audit, diagnosis, or recommendation for any specific organization.

Cite this Brief

Lemma Critical Team. (2026).
"Onamae.com Desktop Cloud: Malicious programs were placed on rented servers, and customers reported trades they did not make".
Lemma Critical Brief No.165. Lemma / FRAME00, Inc.
https://lemma.frame00.com/critical/briefs/165-gmo-onamae-desktop-cloud/
Read nextNext
Same control Capcom: Passwords on CAPCOM ID shared accounts were changed without authorization, and some online-store account pages were accessed too Identity & Auth Same control TVING: Development projects taken with a developer key held production keys, and user data leaked (Korean government investigation) Identity & Auth Latest Binance: Unauthorised withdrawal transactions went through, and crypto was taken Agent Infrastructure
All Briefs →
Lemma

If it can't be verified,
it doesn't enter your operation.

Lemma is a pre-execution check: logins, payments, records and publishing that look genuine are checked before they run, with cryptographic proofs the receiving side verifies without asking the issuer. Detection stays; the check sits in front of it.

Talk to enterprise See the verification center