GMO's Onamae.com Desktop Cloud extortion case and So-net's 2.59 million-record leak: what companies should check this week

Key points for company leaders

This article reflects information available on the morning of 28 October 2026 (Japan time). Both incidents are still under investigation, and neither company has published the cause yet. For the latest, check the announcements listed in the sources at the end.

• GMO: a break-in at a cloud desktop service

  On 20 October GMO Internet confirmed that an outsider had installed malicious programs in some customers' server environments on Onamae.com Desktop Cloud. 26,739 servers may be affected, and from 4:00 on 21 October the company began shutting down servers on every plan.^[1]

• GMO: extortion and published data

  The company says it received a threatening email demanding about 8 billion yen on 21 October. It will not pay and has consulted the police. At 12:30 on 27 October it confirmed that people believed to be the attackers had published what they claim is information about the company and its customers. Some customers have also reported trades in their trading accounts that they do not recognise.^[2][3]

• So-net: 2.59 million member records

  According to Sony Network Communications, the So-net member database was accessed without authorisation on 19 October, and 2,585,481 So-net and plala (S course) member records leaked, including names, phone numbers, email addresses and dates of birth. For some mail services, 54,401 email addresses and their passwords also leaked. No credit card data was included.^[4]

• What to do this week

  Check whether any staff use Onamae.com Desktop Cloud or So-net or plala mail for work. If they do, change passwords as each company instructs and turn on multi-factor authentication. Tell all staff not to respond to emails, text messages or calls that claim to come from either company or related organisations.^[5][4]

What happened at GMO's Onamae.com Desktop Cloud

Onamae.com Desktop Cloud is a cloud server environment that customers connect to from their own PCs. In its fourth report, GMO Internet said its investigation had confirmed that the service's systems had security vulnerabilities, that the environment was accessed without authorisation, and that customer information was taken outside the company.^[2]

According to the company, the people believed to be the attackers threatened that, if it refused, they would keep making unauthorised trades in customers' accounts at more than 70 securities and FX firms in Japan and abroad, publish information about the service and the customer PCs connected to it, and launch ransomware attacks. In response, the company asked major exchanges and securities firms to block access coming through the service and to force-end active sessions. As of 13:55 on 27 October, no ransomware attack had been confirmed.^[2][3]

The company says it will pay a flat 5,000 yen to every current user and compensate actual losses from unauthorised trades. It has also asked the government to treat the case as the first use of Active Cyber Defense, the framework under which the state can act against attackers' infrastructure.^[2]

What leaked at So-net

The leaked member data covers names, phone numbers, email addresses, user IDs, dates of birth, gender and internet connection IDs. Member login passwords did not leak. Current members and people who left from March 2026 onwards are affected. Separately, 16 sets of bank account details and 7 password-reset notices also leaked. No leak has been found in the company's other services, including NURO.^[4]

So-net says that, with the email addresses and passwords exposed, a third party could read and send those users' mail through a mail app or webmail. From about 10:00 on 27 October the company has been resetting the affected mail passwords, and users must set a new one from My Page to use the mailbox again.^[6]

Timeline

How the two cases differ

If your staff use these services

• Asked staff whether they use Onamae.com Desktop Cloud for work, including accounting or trading
• Changed any IDs and passwords stored on that server, and changed the same passwords on other services^[1]
• Removed any unrecognised linked apps, forwarding rules, extensions and registered devices from mail and cloud accounts^[5]
• Staff who use So-net or plala mail for work have set a new password^[4]
• Told all staff not to visit or share what the attackers claim to have published^[3]
• Told staff to ignore offers to recover lost money for a fee^[5]

Common questions

How ZeroKai can help

Both incidents happened inside the service providers' own systems, where customers cannot see. What you can see is which of your own servers and remote access entry points are exposed to the internet. ZeroKai takes your domain, lists the host names recorded in Certificate Transparency logs and highlights names that look like admin screens or test environments. For domains whose ownership you have verified, it also shows exposed remote access, file sharing, database and FTP services observed by Shodan.