GMO Desktop Cloud breach exposes 26,000 FX servers

GMO Internet Group’s GMO Desktop Cloud suffered a major security breach that affected more than 26,000 servers dedicated to foreign exchange trading. The attackers were able to exfiltrate sensitive client records and initiate unauthorised financial trades across user accounts. Leadership responded by suspending operations to contain the damage, while forensic work and liaison with financial counterparties were undertaken to freeze illegitimate trades and terminate compromised sessions.

The extortionists published a detailed analysis of misconfigurations within GMO’s virtual workspace, noting centralised Microsoft Active Directory controls over the VPS network and broadly privileged administrator accounts across client nodes. The report alleges that support technicians stored generic superuser credentials in memory when connecting to remote clients, enabling persistent access for the attackers.

In addition, default Remote Desktop Protocol settings enabled local drive redirection, allowing mapped drives to be accessed from compromised sessions. The incident is said to have existed since 2019, with backdoors planted prior to the ransom demand of one million dollars by 27 October. GMO rejected the extortion and provided forensic telemetry to law enforcement, with a plan to retire legacy architecture and reimburse affected customers.

Initial compensation is 5,000 yen per customer, with full reimbursement for verified trading losses and brokerage fees, and a shift toward a zero-trust approach as part of rebuilding trust. The incident disclosure references the GMO Desktop Cloud server suspension and notes a permanent decommission of the compromised infrastructure.