Observed Signal · Oct 27, 2026 · Security Breach · Source: techcrunch · Impact: 4/5 · Sentiment: Negative
GMO Internet Confirms Customer Data Leaked in Cloud Breach
Japanese internet giant GMO Internet is investigating a data breach after unauthorized access to its Onamae Desktop Cloud service, which provides virtualized desktops for financial traders. The company believes the attacker has posted information linked to customers and its business, but the full extent remains unclear. GMO advised customers to reset passwords amid reports of unauthorized operations on trading accounts, and 27,000 servers may be affected. The breach occurred around the same time that GMO's cybersecurity unit reported evidence of a Chinese AI-powered penetration tool, Artex, being used in hacks across Japan, though no connection has been established. GMO shut down the service on October 21, reported the incident to police, and is collecting devices from customers to detect malware. The company is offering compensation and alternative services.
This is a significant cybersecurity incident involving a major Japanese internet company, affecting thousands of servers and potentially exposing sensitive customer data. It highlights growing cyber threats, including the use of AI-powered tools, which is relevant to the AdTech industry due to data security concerns.
Track GMO Internet Group Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your Polaris7 workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- GMO Internet reported unauthorized access to its Onamae Desktop Cloud service, affecting 27,000 servers.
- The attacker allegedly posted customer and business data, which is being verified.
- GMO shut down the service on October 21 and reported the incident to Japanese police.
- Hackers demanded about 8 billion yen (~$50 million) in ransom.
- GMO's cybersecurity unit found evidence of Chinese AI tool Artex used in hacks in Japan, but no connection to this breach established.
Connected Companies & Entities
2 Entities mapped“Japanese internet company GMO Internet is investigating a data leak after unauthorized access to its Onamae cloud desktop service.”
“The Artex tool was also used to hack financial institutions in South Korea in September, according to a report by CrowdStrike.”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Tenga: Hacker Stole Customer Information
Japanese sex-toys maker Tenga notified customers that an unauthorized party accessed a professional email account of one of its employees, exposing the inbox contents and potentially customer names, email addresses and historical correspondence — which may include order details or customer-service inquiries. TechCrunch obtained the notification email, which said the intruder also sent spam to the compromised account’s contacts. A forensic review communicated to TechCrunch found the breach affected approximately 600 people in the United States; it is unclear whether customers outside the U.S. were impacted. Tenga said it reset the employee’s credentials and enabled multi-factor authentication across its systems, and recommended customers change passwords and watch for suspicious emails. The company noted it has shipped over 162 million products worldwide. The report was first published Feb. 13 and updated with a Tenga spokesperson’s comment.
Apollo Global Management confirms cloud data breach
Apollo Global Management confirmed a cyberattack on parts of its cloud infrastructure in which attackers used social-engineering techniques to gain access between July 6 and July 10, 2026, and exfiltrated large amounts of personal information. A notification filed with the California Attorney General says stolen data reportedly included names, birth dates, contact details (including home addresses) and Social Security numbers; it does not specify whether affected records relate to Apollo employees or staff at portfolio companies. Security researchers say the incident is part of a broader extortion campaign targeting large financial and private-equity firms—Google-linked teams have associated the activity with groups labeled Falcon, Helix, Pink and Redact—and that attackers harvest credentials and demand ransoms. Apollo has not disclosed whether ransom demands were met or the full scope of the breach.
CERT-EU Blames TeamPCP for European Commission Data Breach
CERT-EU reported that a cybercriminal group known as TeamPCP breached an Amazon Web Services account used by the European Commission, stealing roughly 92 GB of compressed data from the Commission's Europa.eu cloud infrastructure. The stolen material — later posted online by the hacking group ShinyHunters — included names, email addresses and the contents of emails; CERT-EU said at least 29 other EU entities and dozens of internal Commission clients may be affected. The agency traced the intrusion to March 19 after attackers acquired a secret AWS API key following a supply-chain compromise of the open-source security tool Trivy. CERT-EU is contacting affected organizations and continues analyzing the published data.
Receive all future signals for GMO Internet Group & competitors in your briefing
Never miss material M&A deals, leadership changes, account wins, or product rollouts. Polaris7 monitors 20,000+ primary sources 24/7, delivering verified telemetry directly into your executive briefing.