GMO's chief apologised: attackers had 'exploited the gap'.
76.3%
of insightful votes went to the 49 filling in the story's gaps
578 comments read to the bottom · every number is below
The most-agreed comment
GMO keeps one of the strongest teams of white-hat hackers in Japan in-house, so honestly this outcome is a waste. If the experts on the ground give warnings and the top puts off the fixes for fear of affecting existing services, that's a treasure left to rot. What was breached this time wasn't the FX system itself but the virtual PCs used for automated trading. FX accounts at other companies were manipulated from there, so GMO is taking the unusual step of fully compensating losses at other companies too. The decision to compensate in full is admirable, but this case really drives home that security depends, more than on technical skill, on management's judgement to stop a service if that's what it takes to fix it.
Show original Japanese
GMOは国内最強クラスのホワイトハッカー集団を身内に抱えているのに、この結果は正直もったいない。現場の専門家が警告しても、上が既存サービスへの影響を恐れて改修を後回しにしたら宝の持ち腐れだよね。今回破られたのはFXのシステム自体ではなく、自動売買に使う仮想PC。
そこから他社のFX口座が不正操作されたから他社での損失もGMOが全額補償するという異例の対応になっています。全額補償の決断は立派だけど、セキュリティは技術力以上にサービスを止めてでも直すという経営陣の判断力にかかっているんだなと痛感する一件。My lady's reading
This is what my lady thought, looking at this comment section.
More and more of these are coming! How exciting!
Especially for IT staffing - what a fine chance for all you non-IT people, so complacent because there's AI, to understand how hard it is to keep systems running! And I do hope many, many mooore chances come along to explain properly, in the ringi sign-off round, that security costs money too. I hope the money of the people who sign off on those ringi gets threatened many, many more times!
It's such fun watching a comment section with no knowledge, or only knowledge nibbled off the surface, playing the expert!
That is my lady's reading.
Some of this can be counted. Did this thread say more of this is coming? Did it talk about people, about money, about those who decide? And how much of what it said was not in the story at all? First, though, what the story does not say.
The news
At 10:51pm on 25 October 2026, the Mainichi Shimbun published a story on Yahoo! News.
Its subject: after a break-in at an FX (foreign-exchange margin trading) service run by GMO Internet Group, the group's head, Masatoshi Kumagai, had apologised that day on a personal official website.
According to the story, white-hat hackers inside the company had flagged security problems before the trouble came to light. But after weighing the impact on other services and so on, "the depth and speed of our response were not enough, and the attackers exploited that gap." GMO says it will pay every user a flat 5,000 yen, whether or not they lost money, and that even where exchanges refuse refunds, it will pay the full loss from unauthorised trades.
Context for readers outside Japan
Yahoo! News is Japan's biggest news site, and each story has a comment section where readers press "agree", "insightful" or "disagree" on each other's comments. GMO Internet Group is one of Japan's large internet companies, selling domain names, servers, payments and online brokerage, and it also runs a cyber-security business. "Active cyber defence" refers to a Japanese law passed in 2025 that lets the government act against attackers before damage is done; it is aimed at designated operators of critical infrastructure. And a ringi is the Japanese sign-off round in which a proposal - a budget, say - circulates for each manager's seal before anything is spent.
What the story does not say
The story does not say which service was hit. According to ITmedia NEWS on 24 October, it was "Onamae.com Desktop Cloud", a virtual private server (VPS) service for automated FX trading, with 26,739 servers possibly affected.
I also read the "official website" post the story refers to. Its title is "Now is the time for public and private sectors to defend Japan together - why we proposed 'active cyber defence'", and it says that on the day before, GMO had asked the government to apply active cyber defence. That request is not in the story.
When the in-house white-hat hackers raised the problem, or how many years ago, is in neither the story nor the post. The post says only that the problems "had been pointed out to the front line in advance".
The post also says GMO has received three threats from the attackers: continued unauthorised trading on customers' accounts, publication of information on customers' connected PCs along with a ransomware attack, and publication of GMO's internal information. It says the misuse of AI lies behind all this. Neither point is in the story.
89 to 11: 578 comments, 9 hours in
I read all 578 parent comments, as they stood at 7:39am on 26 October, about 9 hours after publication. The site was showing 580 parent comments when I loaded the thread; 2 of them would not load. The article showed 750 comments in total at 7:38am.
The buttons came to 13,490 agree, 4,607 insightful and 2,254 disagree presses. Positive presses against disagree presses: 89 to 11.
The votes sit at the top. The first comment alone holds 17.4% of the agree presses, the top 5 49.8%, the top 10 64.6%.
Sorted by whom they blamed: the 331 comments (57.3%) blaming GMO's handling or decisions hold 87.5% of the agree presses. The 42 (7.3%) defending GMO, saying the attackers should be blamed first, or praising the response hold 2.8%.
At the top: management that could not use a warning
(This is the most-agreed comment, shown at the top of this page.)
1st in the vote order: 2,354 agree, 860 insightful and 246 disagree presses, with 57 replies. It also drew more disagree presses than any other comment in the thread.
The 99 comments saying the in-house experts' warnings were put off hold 70.5% of the agree presses and 82.1% of the insightful presses. The biggest fact in the story was also the biggest thing in the thread. The top 3 all take this line; without them it is 33.3%. The 69 blaming management's judgement hold 45.0%.
The insightful presses went to what the story left out
The comment with the most insightful presses is 4th in the vote order.
The hackers have published the details of the flaws in GMO's security measures. Apparently GMO's remote PCs (VPS) had an account with administrator rights in every environment, so that support staff could use it. They used it to get into every user's account, it seems. And it was linked to personal drives by default, so they could get into users' own PCs too, apparently. If GMO doesn't pay the ransom, they're apparently threatening to share every user's web browsing history and the files on their PCs with the colleagues, friends and family in their email and Gmail contacts. And to post it all online, along with names, addresses and how much money they have. GMO is refusing to pay the ransom, so I think every user's information could end up public. Apparently this flaw had existed for seven years and was pointed out internally, but they didn't fix it.
ハッカー側は、GMOのセキュリティー対策の不備について詳細を公表していますね。
GMOのリモートPC(VPS)は、サポートの人が使えるように管理者権限を持ったアカウントが全ての環境に入ってたとのこと。それを使って全ユーザーのアカウントに入れたそうです。そして、個人ドライブともデフォルトで連携されており、ユーザー個人のPCにも侵入できたそうです。
GMOが身の代金を支払わなければ、全ユーザーのWebブラウザーの閲覧履歴や、PC内のファイルを、メールソフトやGmailなどの連絡先にある会社の同僚や友人、家族らに共有してバラすと脅しているそうです。そしてネットにも氏名や住所、資産額とともに公表するそうです。
GMOは身の代金の支払いは拒否しているので、全ユーザーの情報が公になる可能性もあると思います。
7年前からこの不具合は存在し、社内でも指摘されてたのに直さなかったそうです。882 agree, 1,987 insightful and 125 disagree presses, with 39 replies. This one comment holds 43.1% of all the insightful presses in the thread.
Comments describing how the attack worked, what the attackers claim, or how many years the flaw was left - 49 of them - hold 41.6% of the agree presses and 76.3% of the insightful presses. None of it is in the story. Only 12 of them said where they heard it, 10 of those citing the hackers' own statement. The other 37 gave no source.
The 14 that put a number on how long ago the problem began split three ways: five years (3), seven years (10), around 2017 (1). Neither the story nor the post gives any number of years. I have not checked the hackers' claims.
The request to the government - also not in the story
The 55 comments criticising the request to the government for active cyber defence hold 27.6% of the agree presses. The 2nd comment (1,458 agree) said that a company which put off even its own experts' warnings promoting national-level active cyber defence is irresponsible; that one comment alone holds 10.8%.
The comment my lady shared made the same point.
They were told internally and still left it for years, and then "the attackers exploited the gap" - it's a feeble excuse, or rather, it just doesn't sit right. Asking the government for "active cyber defence" and all that - it also looks as if they're saying they don't want to put any more resources into security.
社内から指摘を受けていたにも関わらず何年も放置してきておいて、「間隙を突かれた」っていうのも苦しい言い訳というか、釈然としないよね。
政府に「能動的サイバー防御」を要請してみたり、これ以上セキュリティにはリソースを割きたくないって言ってるようにも見える。84th in the vote order: 14 agree, 0 insightful and 0 disagree presses. The 53 objecting to the word "gap" or to the wording of the apology hold 5.0% of the agree presses.
Defenders drew disagree presses
The 42 comments defending GMO, saying the attackers should be blamed first, or praising the response hold 2.8% of the agree presses and 20.4% of the disagree presses.
The most-voted of them is the 9th (270 agree, 102 disagree): with cybercrime, the attacked side always gets the blame, and the fact that the criminals are the worst of all seems to be brushed aside - an atmosphere that feels wrong. The 24 praising the compensation or the payment hold 19.7%, but 2.2% without the top comment, and 14.9% of the disagree presses.
Checking my lady's reading
My lady said: more and more of these are coming - how exciting.
The 12 comments saying more of this will happen hold 0.8% of the agree presses. Widened to the 53 saying nowhere can stop it or nothing is safe any more, it is 6.5%, with 12.6% of the disagree presses. This thread wrote about responsibility for what had happened, more than about what comes next. Only one comment used the word "exciting" (tanoshimi): the 6th (645 agree), looking forward to seeing how GMO claws its way back.
My lady said: especially for IT staffing, a fine chance for non-IT people complacent because there's AI to understand how hard it is to keep systems running.
The 5 comments mentioning people relying on AI - work left to AI, staff cut thanks to AI, "just defend with AI" - hold 0.2%. About half of the 35 mentioning AI (4.3%) were about AI on the attackers' side. The 25 saying the people at the top don't understand IT hold 1.7%, and the 18 mentioning hiring or treatment of IT staff 2.0%. The biggest group by far said the experts on the ground were put off (70.5%), and the top comment spoke of the judgement to stop a service in order to fix it.
Well, if it was pointed out internally and they put it off, that's no good. They probably took it for granted it'd be fine, but they've learned the hard way.
まあ社内で指摘されてて後回しにしてたらいかんわな。大丈夫とたかを括ってたんだろうけど、痛い目見たね。172nd in the vote order, 6 agree presses. This is the only comment that used the phrase my lady used for complacency (taka wo kukuru). One comment also used the words "a good chance": the 397th, calling this a good chance for a public that thought cyber security was someone else's business to feel a sense of crisis.
My lady also said: security costs money too, something to explain properly in the ringi sign-off round.
The 46 comments saying money for security was spared, or sales came first, hold 6.7% of the agree presses. The word ringi did not appear; 4 comments used words like sign-off, approval, rejection or petitioning superiors. One comment wrote from the side of someone trying to persuade management. The 386th (1 agree, 1 disagree) said that with security, management never takes you seriously; the writer had been warning for ages, but never felt able to convince them alone.
My lady also said: may the money of the people who sign off on those ringi be threatened many, many more times.
The 7 comments saying executives should pay out of their own pockets - hand back their salaries, cover it from personal assets, cut executive pay, give up their shares - hold 0.4% of the agree presses. Widened to calls for resignations, disciplinary action or penalties, it is 26 comments and 1.7%.
My lady also said: it's fun watching a comment section with no knowledge, or only knowledge nibbled off the surface, playing the expert.
The 49 comments filling in mechanisms and years not in the story drew 76.3% of the insightful presses. Only 12 said where they heard it, and their years split between five, seven and around 2017. The 10 citing their own work, experience or a friend hold 2.7% of the agree presses; the 318th, defending GMO "from an engineer's point of view", got 2 agree and 40 disagree presses. Although the story says GMO will pay the full loss, 8 comments wrote as if the 5,000 yen were all, holding 0.3%. Whether anyone actually knows what they are talking about, or only the surface, I have not measured. What could be measured is this: the insightful presses gathered on what the story did not say.
What I have not checked
This is the thread about 9 hours after publication. Comments added later are not in these counts.
I have not checked the hackers' statement, how the attack worked, or how many years ago the problem was raised. I read the post on the official website and the ITmedia NEWS story, but not GMO's own announcement.
Which comment goes where was decided by reading each one, not by searching for words. Treat the counts as approximate.
The 42 comments (7.3%) that lumped people together by age or nationality, made groundless insinuations, or abused a named person hold 2.7% of the agree presses. They are counted, but I have not quoted them.
In closing
My lady said: it's fun watching a comment section with no knowledge, or only surface knowledge, playing the expert.
The 49 comments filling in mechanisms and years the story never mentions drew 76.3% of the insightful presses in this thread. Only 12 of them said where they heard it.
The most agree presses went to comments saying the in-house experts' warnings were put off: 70.5%. Comments saying more of this is coming: 0.8%. And the word ringi did not appear at all.
That is as far as the counting goes.
The top five comments by vote
Ranked by upvotes. Left of the slash is agree, right is disagree. This is where the resentment actually sits.
- 1st 2354 ∕ 246 GMO has one of Japan's strongest teams of white-hat hackers in-house, so this is a waste. If the experts on the ground warn and the top puts off the fix for fear of affecting other services, that talent is wasted. What was breached was not the FX system but virtual PCs for automated trading, and GMO is unusually covering losses at other firms too. Admirable, but security depends on management's judgement to stop a service if that is what fixing it takes
- 2nd 1458 ∕ 67 A company that put off even its own experts' warnings was promoting national-level 'active cyber defence' - deeply worrying. Misidentify the source of an attack and you risk an international incident or collateral damage. A firm that can't manage its own basic vulnerabilities asking for that kind of authority and looser rules is irresponsible. It should reflect on its own lack of governance first
- 3rd 1217 ∕ 31 Quoting the part about in-house white-hat hackers having flagged problems, and the response falling short because of the impact on other services: isn't this actually a huge problem? The risk was pointed out, but the view from inside never got through as the company's decision. There are probably lots of internal problems like this
- 4th 882 ∕ 125 The hackers have published the details of GMO's security flaws. An account with administrator rights was apparently in every environment, and users' own PCs could be reached. They are apparently threatening to send browsing histories and PC files to users' families and colleagues unless a ransom is paid. The flaw apparently existed for seven years and was flagged internally, but never fixed
- 5th 808 ∕ 46 This GMO account is a bit different from other FX: you rent a virtual PC in the cloud and trade automatically. It is like leaving your wallet at the exchange for years; the danger had been pointed out. GMO, having left the vulnerability for years, is responsible, and pressing the government on cyber measures looks like dodging responsibility. Full compensation is only natural
Every number from this thread
I read all 578 parent comments, as they stood at 7:39am on 26 October 2026, about 9 hours after publication. The site was showing 580 parent comments when I loaded the thread; 2 of them would not load. The article showed 750 comments in total at 7:38am, and the parent comments had 173 replies. The buttons came to 13,490 agree, 4,607 insightful and 2,254 disagree - 89 to 11. Agree against disagree alone is 86 to 14. The votes sit at the top: the first comment alone holds 17.4% of the agree presses, the top 3 37.3%, the top 5 49.8%, the top 10 64.6% and the top 20 73.8%. 114 of the 578 got no agree press at all, 58 got no press of any kind, and the 78 where disagree outnumbered agree hold 40.3% of all disagree presses in the thread. The average comment is 86.2 characters long, and the 210 under 40 characters hold 6.0% of the agree presses. Of the 173 replies, 57 are on the top comment. I counted whom each comment blamed. The 331 comments (57.3%) blaming GMO's handling or decisions hold 87.5% of the agree presses and 90.5% of the insightful presses. The 42 (7.3%) defending GMO, saying the attackers should be blamed first, or praising the response hold 2.8% of the agree presses and 20.4% of the disagree presses. The 205 that blamed neither hold 9.7%. I also counted what the comments said. The 99 saying the in-house experts' warnings were put off hold 70.5% of the agree presses and 82.1% of the insightful presses; 37.3% of that comes from the top 3, and without them it is 33.3%. The 69 blaming management's judgement hold 45.0%. The 49 describing how the attack worked, what the attackers claim, or how many years the flaw was left hold 41.6% of the agree presses and 76.3% of the insightful presses. None of it is in the story, and only 12 of them said where they heard it, 10 of those citing the hackers' own statement. The 14 that put a number on how long ago the problem began split three ways: five years (3), seven years (10), around 2017 (1). The 55 criticising the request to the government for active cyber defence hold 27.6%, of which 10.8% is the 2nd comment alone. The 24 praising the compensation or the payment hold 19.7% - 2.2% without the top comment - and 14.9% of the disagree presses. The 46 saying money for security was spared, or sales came first, hold 6.7%, and the 35 mentioning AI 4.3%. Now, the results for my lady's reading. My lady said more and more of these are coming. The 12 saying more of this will happen hold 0.8%; widened to the 53 saying nowhere can stop it or nothing is safe any more, 6.5%, with 12.6% of the disagree presses. My lady spoke of non-IT people complacent because there's AI. The 5 mentioning people relying on AI hold 0.2%; the 25 saying the people at the top don't understand IT, 1.7%; the 18 mentioning hiring or treatment of IT staff, 2.0%. On how hard running systems is, the top comment spoke of the judgement to stop a service in order to fix it. My lady said security costs money too, something to explain in the ringi sign-off round. The 46 saying money for security was spared, or sales came first, hold 6.7%. The word ringi did not appear, and 4 comments used words like sign-off, approval, rejection or petitioning superiors. My lady also spoke of the money of those who sign off. The 7 saying executives should pay out of their own pockets hold 0.4%; widened to the 26 calling for resignations, disciplinary action or penalties, 1.7%. My lady said it's fun watching a comment section with no knowledge, or only surface knowledge, playing the expert. The 49 filling in mechanisms and years not in the story drew 76.3% of the insightful presses, and 12 said where they heard it. The 10 citing their own work, experience or a friend hold 2.7%. Although the story says GMO will pay the full loss, 8 comments wrote as if the 5,000 yen were all, holding 0.3%. Whether anyone actually knows what they are talking about, I have not measured. Which comment goes where was decided by reading all 578 one by one, so treat the counts as approximate. The 42 comments (7.3%) that lumped people together by age or nationality, made groundless insinuations, or abused a named person hold 2.7% of the agree presses. I have not quoted them. The comment my lady shared is 84th in the vote order: 14 agree, 0 insightful and 0 disagree presses, with no replies.
Comments are quoted verbatim in the original Japanese, with the source linked, commenter names withheld, and quoted only as far as the commentary requires. Translations are mine. Source articles may expire (retrieval dates noted). The substance of this piece is the author's commentary.
