October was a month marked by a continuous stream of reports regarding security incidents in Japan. Particularly shocking was an unauthorized access incident involving "Onamae.com Desktop Cloud"—a virtual server service provided by GMO Internet, designed for automated foreign exchange (FX) trading. According to the company, malicious programs were discovered on some customer server environments on October 20, leading to the suspension of all service plans the following day.
The incident potentially affected 26,739 servers (though the company noted that this figure does not represent the number of confirmed cases of actual damage). Login credentials for brokerage and FX trading accounts—stored within these servers—were accessed by third parties, resulting in unauthorized, repeated trades in users' accounts. The Asahi Shimbun reported one instance where a user lost over 4 million yen in approximately two seconds.
The suspected attackers sent a ransom demand on October 21, requesting 50 million USD (approximately 8 billion JPY). A document accompanying the demand—posted on the blog of CEO Masatoshi Kumagai—specified Bitcoin and Ethereum as the required payment methods. GMO refused to pay, and as threatened, the attackers began releasing what they claimed to be stolen data shortly after midday on October 27. In response, GMO announced plans to compensate users for losses from unauthorized trades and provide solatium payments, while also offering a reward of up to 1 million USD. The company even requested that the government invoke "active cyber defense"—a framework allowing the government to intervene directly at the source of an attack to neutralize the threat. CEO Kumagai himself acknowledged that, despite prior warnings from the company’s internal "white-hat" hackers, the response was neither sufficiently thorough nor fast enough. On October 26, shares in the GMO group fell by more than 11% at one point on the Tokyo stock market.
On October 28, Japan Airlines (JAL) and Japan Transocean Air announced that Amadeus—the third-party provider for their passenger service system, which handles reservations, ticketing, and boarding procedures—had also been subjected to unauthorized access. There are signs that reservation data for approximately 92,000 individuals was accessed by an external party; for about 2,000 of these, the exposed information may include details such as passport numbers. The unauthorized access appears to have spanned more than three years, from August 2023 to September 2026. South Korea’s Korean Air and Asiana Airlines have also previously disclosed incidents involving the same system—Amadeus.
When viewed together, the patterns are strikingly similar. The breach did not occur at the primary, central vault; rather, it is as if a leak sprung from the plumbing managed by a third-party contractor, or from the place where a spare key—entrusted by a customer—was being kept.
That same week, an incident also occurred in the world of crypto-assets, involving Keystone, a manufacturer of hardware wallets.
According to a statement from the company, it detected unusual activity on its official website—hosted on Shopify—on October 20. The intrusion reportedly stemmed from a privilege escalation exploit targeting a vulnerability in a third-party data monitoring tool integrated into the site. Neither the name of the tool nor the date of the initial breach has been disclosed. While an initial report on October 24 mentioned only the exposure of customer shipping information, a more detailed statement on October 26 revealed that "WebAuth keys"—used to verify the authenticity of the devices—had also been stolen.
The leaked records, totaling 25,964 entries, contained names, contact information, addresses, and order details. This data should have been deleted; although the company had announced in 2023 that it would shorten its data retention period to 180 days, an automated deletion tool failed in some instances, leaving the data intact without anyone noticing.
The theft of the keys is the more serious issue. WebAuth keys are stored in a memory area that can only be written to once during the manufacturing process; they cannot be erased or overwritten. Keystone has destroyed 18,835 units containing the compromised keys and has halted direct shipments from its official website, switching instead to a pre-order model. The company states that devices equipped with new, secure keys will be shipped within four to six weeks. To avoid any misunderstanding, it should be noted that this key is not used for generating seeds or signing transactions; therefore, assets cannot be directly drained from a genuine device in your possession. As of October 29, there have been no reports of counterfeit devices in circulation or of any such devices being stolen. The company states that devices received prior to October 20—provided they have passed an authenticity check—can continue to be used as normal. For devices received on or after that date, the company advises users not to deposit any funds and to contact their support team for verification.
.png&w=3840&q=75)