Data leaks hit GMO and Sagawa; cabinet meets on cyber

1. What happened

An unauthorized third party got into "Onamae.com Desktop Cloud", a VPS service for automated FX trading run by GMO Internet Group. In a notice dated October 21, 2026, the company said malicious programs had been installed in some customers' server environments, that 26,739 servers may be affected, and that it would stop servers on all plans in turn from 4:00 that day (official Onamae.com notice). According to J-CAST News, the group said on October 22 that login details for trading accounts stored on the servers may have been obtained and misused. Reports of unauthorized operations on securities and FX accounts have come in, and one user says about 3 million yen was lost (J-CAST News via Yahoo News Japan).

2. The government's response

At a press conference on October 26, Chief Cabinet Secretary Minoru Kihara said that large-scale leaks of information from attacks on businesses keep coming, and announced that a cabinet ministers' meeting on cybersecurity would be held at the Prime Minister's Office at 6 p.m. the same day. Prime Minister Takaichi and others are due to attend and discuss further measures, but no specific measures had been given when the announcement was made. As background, Business+IT cites Sagawa Express's October 23 statement that up to about 53.23 million records (a count that includes duplicates) of personal information may have leaked through unauthorized access to its parcel-tracking service, and GMO's request that the government apply "active cyber defense" (Business+IT via Yahoo News Japan).

On October 25, GMO Internet Group chief Masatoshi Kumagai said on his blog that in-house white-hat hackers had pointed out issues to be fixed to the operating team beforehand. According to ITmedia, he explained that the response was handled "carefully, weighing the effect on availability and priority against other matters", and did not disclose what was flagged or why the fix was late. ITmedia reports that criticism on social media, such as "this shifts the blame", is the dominant reaction. Whether the attackers' own account of how they got in is true is also unknown, since GMO has not disclosed details (ITmedia NEWS).

3. Why it matters to small businesses

What matters in this case is less the names of the companies hit than the fact that the same thing can happen to any company in the same way. A VPS, an outward-facing lookup screen such as parcel tracking, and data entrusted to a business partner are all parts outside your own company, yet what leaks from them becomes damage to your customers and your funds. As reported, the GMO case may involve misuse of login details stored on servers, while the Sagawa case covers the names, addresses and phone numbers of senders and recipients, with credit card data and passwords stated to be outside its scope. A company that holds online sales or shipping records may find its own customers in the same position.

Our view The heaviest lesson here is that a hole judged "to be fixed later" can become the day of the damage. GMO's own chief has admitted that the warnings came beforehand. Many small firms are likely to be putting off advice from their web agency or in-house staff, such as "stop reusing passwords" or "close the old server", because they are busy. The cost of putting it off is explaining to customers after an incident, considering compensation, and losing the sales of the period when the service was down. We think whether you list the data and servers entrusted to outside parties within this month, and whether you stop sharing and reusing passwords, will decide whether you are on the receiving end of the next case.

4. What small businesses should check now

Review the servers you keep outside, such as VPS and rental servers, find those that are unused or no longer updated, and close the contracts you do not need
Check whether login details for trading accounts, cloud services or email are saved inside servers or business systems. If so, change the passwords now and stop reusing them
If you use Onamae.com Desktop Cloud, check your trading account history and balance and change passwords. Do not open URLs or files in emails from anyone claiming to be the intruder, and do not reply (GMO's appeal)
Read the latest notices from companies that hold your shipping or customer records (carriers, e-commerce, booking systems) and decide whether you need to contact your own customers
Write down with your web agency or maintenance company who handles updates and when, and who to contact if something happens

Our outlook

We expect this run of cases to strengthen the push by customers and business partners to ask small firms where their information is kept and how it is managed. Within 6 to 24 months we think security questionnaires from buyers will multiply, and companies that cannot submit one will drop out when suppliers are compared. The government held a ministers' meeting on the same day, and demands on businesses may tighten. The faster AI speeds up the search for weak points, the shorter the period in which a configuration gap can be left alone. Having a list of entrusted data and outside servers, a password rule, and named owners for updates and contact in place now is, in our judgment, what makes now the time to lay the groundwork.

Our overall view

This was not something that happened because the company was large; it is the kind of accident that can happen at any size when "fix it later" piles up. The outcome of the ministers' meeting was not out at the time of writing, so we cannot yet confirm what the government will ask of businesses. We recommend starting with two steps that cost little: taking stock of outside servers and reviewing passwords.

Questions this article answers

What should users of Onamae.com Desktop Cloud do after the intrusion?

GMO asks users to change credentials stored on the servers promptly, and to change the same password elsewhere if it was reused. It also urges checking trading account history and balances. Do not open URLs or files in emails from anyone claiming to be the intruder, and do not reply.

What should a small firm check when a large business partner suffers a leak?

First check the partner's latest notice to see whether your information is covered. Then look at what kinds of data you have entrusted to them and whether the same login details are used elsewhere. If your own customers could be affected, decide early whether you need to contact them.

Sources

Related Q&A

Related services

If you want to try this in your own business

To see how the topics in this article would apply to your own operations, and what it would cost, send us a message through the contact form.