> ## Content Index
> Fetch the complete content index at: https://tokyobrainie.ghost.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# Quick Cut 017｜五千円では、信頼はロスカットできない——GMOクラウド侵害、殿様OSの緊急更新｜JPY5,000 Cannot Stop Out a Loss of Trust
- URL: https://tokyobrainie.ghost.io/news-cutting-room-403bc361-83408ae0-en/
- Published: 2026-10-23T15:00:00.000Z
- Updated: 2026-11-11T00:18:30.000Z
- Description: I do not want another update on this story. I am tired enough to say I no longer care. That bitter laugh is itself a measure of damaged trust. Nikkei’s October 31 re
- Author: TokyoBrainie
- Tags: News Cutting Room, Signal Room, English, #Import 2026-11-11 08:54

[English](https://tokyobrainie.ghost.io/news-cutting-room-403bc361-83408ae0-en/) · [简体中文](https://tokyobrainie.ghost.io/news-cutting-room-403bc361-83408ae0-zh-hans/) · [日本語](https://tokyobrainie.ghost.io/news-cutting-room-403bc361-83408ae0-ja/)

I do not want another update on this story. I am tired enough to say I no longer care. That bitter laugh is itself a measure of damaged trust.

Nikkei’s October 31 report says GMO Cybersecurity by Ierae warned executives in April 2024 about vulnerabilities, including in [Onamae.com](http://onamae.com/?ref=tokyobrainie.ghost.io) Desktop Cloud, and raised credential-theft and ransomware risks. I have not inspected the internal report. Nikkei also reports an executive’s account that a system-wide overhaul was needed but the response was insufficient. The suggestion that management could not decide to suspend the service is that executive’s interpretation, not a complete established record of the decision process. The company’s spokesperson declined to discuss the individual timing, contents and people involved.

My question is about governance: what value does owning expertise provide if its warnings do not change decisions? The people who raised the warning and the customers should not carry the blame for what followed it. Regret cannot return customers’ time or restore trust. We need a verifiable account of what was known, what was done, what was deferred and how customers were protected.

“Shut the company down. Let it handle nothing but HDDs—or burn the data onto discs.” That is my anger speaking, not a technical prescription. Any closure must protect customers’ assets, data and migration. Changing storage media cannot repair a failure to act on warnings.

Enough updates about apologies. Show evidence that what customers entrusted to you can be protected.

Source: [Nikkei, October 31, 2026, 17:00 JST](https://www.nikkei.com/article/DGXZQOUC30A460Q6A031C2000000/?n%5Fcid=dsapp%5Fshare%5Fios&ref=tokyobrainie.ghost.io). Reporting reviewed through the supplied article captures; the linked page could not be retrieved directly. Reporting and my commentary are distinguished above.

---

## Switching Off the Server Does Not Revoke a Stolen Key

**TokyoBrainie｜27 October 2026 Re-Cut. Latest company statement reviewed: No.10, timestamped 13:55 JST.**

### What changed

GMO says it observed publication of purported company/customer information at 12:30\. Its authenticity was still being checked; ransomware execution was unconfirmed at 13:55\. These are company statements, not my forensic findings. [No.10](https://group.gmo/info/alert/2026102703/?ref=tokyobrainie.ghost.io)

### A timeline is not a complete incident-response log

The 22 October notice records phased shutdown from 21 October and reports received from customers from that date; it also requests password changes and session disconnection and describes coordination with trading providers. [No.2](https://internet.gmo/news/article/247/?ref=tokyobrainie.ghost.io)

The date a report was received is not necessarily the time of the unauthorized action. An abbreviated newspaper table cannot establish that police consultation was the only action after shutdown. Reporting a crime is appropriate; operational containment and customer protection must proceed alongside it. This review does not establish which police force handled the incident.

### The server can be off while a stolen credential still works

As a technical possibility, credentials copied before shutdown could be used from another device against a separate trading service. An already authenticated session may also require invalidation. Whether that happened here, and whether trading, withdrawals or other functions were affected, requires provider logs and timestamps. Do not infer broker-core intrusion or actual withdrawals from reports of unfamiliar operations.

My test for management: when were affected accounts identified, providers alerted, credentials and sessions invalidated, and customers reached? Which measures were completed, and how was effectiveness checked? These are questions, not claims that every measure was absent. A cloud operator cannot necessarily revoke every external broker credential itself; it can coordinate, track completion and explain the remaining exposure.

### The specialists are real. The implementation still needs explaining

GMO announced the acquisition of Ierae in 2022, before this incident. Its cybersecurity organization is not an invention inferred from a crisis statement. [2022 announcement](https://group.gmo/news/article/7573/?ref=tokyobrainie.ghost.io)

Kumagai’s blog says prior improvement issues were raised, but remediation lacked sufficient depth and speed. The correspondence between those findings and the actual entry path has not been independently established here. [CEO blog](https://www.kumagai.com/?eid=19600&ref=tokyobrainie.ghost.io)

**If warnings reached the organization, management must account for their disposition. Employing sentries is no substitute for repairing the gate.** Ask for severity, deadlines, escalation and accountable decision-makers, with sensitive technical details withheld where necessary.

### Refusing ransom does not complete the duty of care

I do not endorse “just pay” as a reliable remedy. UK NCSC guidance explains that payment does not guarantee recovery and may leave infection in place. Payment cannot substitute for containment. [NCSC](https://www.ncsc.gov.uk/section/respond-recover/sole-ransomware-attack?ref=tokyobrainie.ghost.io)

Equally, refusing payment is not proof of successful protection. My demand is for funded assistance, credible remediation and compensation that can actually be claimed. The No.10 statement says an additional goodwill payment for customers whose information is confirmed published is under consideration; an amount and payment date are not established by that statement.

### What matters for the business

For GMO Internet Group (9449) and service operator GMO Internet (4784), study compensation, remediation spending, customer retention and renewal economics separately. New demand for security services does not automatically mean profits for the company whose controls are being questioned. No new share-price or total-loss estimate is asserted here.

**Before asking the state to defend the internet, show how customers are being defended now. A refusal to pay is a policy; protecting customers is an outcome that needs evidence.**

Source note: the supplied Nikkei timeline was reviewed as an image; its article text was not retrievable. The image and leaked personal data are not reproduced. Technical scenarios and editorial judgments above are distinct from company disclosures.

---

## 26 October Re-Cut｜GMO Falls 15.65%: Finding a Weakness Does Not Fix It

**TokyoBrainie｜Post-close study, 26 October 2026\. PTS snapshot: 20:11 JST.**

### Three-line summary

- GMO Internet Group〈9449〉opened 9.29% lower and lost another 7.02% from the open, closing down 15.65%.
- The company says it confirmed unauthorized access and information exfiltration. This review found no evidence establishing that no intrusion occurred.
- My question concerns the organization's ability to turn warnings into repairs, beyond the number of specialists it employs.

### Separate the incident from the adequacy of its explanation

The 24 October disclosure says unauthorized access and customer-information exfiltration were confirmed. This is a company statement, not my independent examination of logs. Unresolved technical details do not establish that the incident was fictitious.[Company disclosure](https://ir.group.gmo/pdf/irlibrary/gmo%5Fdisclose%5Finfo20261024.pdf?ref=tokyobrainie.ghost.io)  
The affected service is subsidiary GMO Internet〈4784〉's [Onamae.com](http://onamae.com/?ref=tokyobrainie.ghost.io) Desktop Cloud. Possible compromise of tools or credentials used to access external trading accounts is distinct from intrusion into a broker's core systems. The 26,739 figure denotes potentially affected servers, not confirmed victims.[23 October update](https://group.gmo/info/alert/20261023/?ref=tokyobrainie.ghost.io)

### The opening decline was followed by further selling

The shared table below uses my observation record. OHLC, volume and prior-session volume were cross-checked against [historical prices](https://finance.yahoo.co.jp/quote/9449.T/history?ref=tokyobrainie.ghost.io); VWAP and intraday timestamps rely on the observation record.  
The high came five minutes after the open; the close was only JPY12 above the low. These daily observations show that the early recovery did not hold. They do not establish an uninterrupted intraday decline, seller identity or completed capitulation.

### Specialists discover; organizations implement

In his 25 October blog, Masatoshi Kumagai says internal specialists had raised improvement issues beforehand, but the depth and speed of remediation were insufficient. The reviewed evidence does not independently map each prior warning to the actual entry path.[CEO blog](https://www.kumagai.com/?eid=19600&ref=tokyobrainie.ghost.io)  
**A castle does not gain a stronger gate merely by employing more sentries while repair approval stalls.**  
I want to know who received warnings, assessed severity, set deadlines, escalated overdue work and verified fixes. These are research questions, not findings assigning individual or board liability.

### Three routes to financial impact

The company outlined goodwill payments, conditional compensation and free alternative service, while saying the consolidated earnings impact could not yet be calculated.[Disclosure](https://ir.group.gmo/pdf/irlibrary/gmo%5Fdisclose%5Finfo20261024.pdf?ref=tokyobrainie.ghost.io)  
My analytical framework separates remediation costs, potential lost revenue from interruption or attrition, and valuation pressure from weaker confidence in controls. The JPY590 decline cannot be allocated precisely among those channels; increased cancellations are not established here. Smaller costs, retained customers and independent validation would support revising a pessimistic assessment.

### A PTS bounce is not proof of resolution

My 20:11 JST snapshot shows JPY3,220.5, up 1.31% from the TSE close, with 4,000 shares and a PTS VWAP of JPY3,218.31\. This is not the night session's final close.  
The JPY41.5 recovery retraced 7.03% of the day's JPY590 loss. PTS volume was about 0.10% of TSE daytime volume; different venues, hours and participants prevent treating that ratio as a direct measure of demand.

### Evidence that could change the assessment

- Clarification of scope, entry path and compensation cost, including the independence and coverage of external validation.
- Whether procedural information planned for 30 October and compensation-application guidance due by 6 November are actually published. These are guidance deadlines, not payment-completion dates.[Disclosure](https://ir.group.gmo/pdf/irlibrary/gmo%5Fdisclose%5Finfo20261024.pdf?ref=tokyobrainie.ghost.io)
- Whether the next session holds above its own open and evolving VWAP. The 26 October final VWAP must not be inserted retrospectively into morning decisions.  
A share-price recovery cannot certify security; validated remediation cannot guarantee a rising share price. **The specialist's signboard and a completed repair are different pieces of evidence.** This is retrospective research, not a trading signal or a bottom call.

---

## His Lordship's operating system: emergency update

Anyone can promise to protect customers' assets in good times. After an incident, that promise must become evidence, procedures and payment.

The affected service is **GMO Internet, Inc.'s** [**Onamae.com**](http://onamae.com/?ref=tokyobrainie.ghost.io) **Desktop Cloud**, not GMO Click Securities itself. A compromised trading environment and a breach of a broker's core systems are different claims. \[1\]

The October 24 announcement offers JPY5,000 in goodwill, separate unauthorized-trading compensation and six free months on an alternative service. \[2\] Calling this “JPY5,000 to settle everything” would be inaccurate. The sharper questions concern the burden remaining afterward.

## Business-card size is not security depth

A close acquaintance who held a senior role at a major systems integrator shared an account circulating in the industry: GMO personnel were said to have treated a counterpart's capabilities dismissively. This is industry hearsay relayed to me, not an account of that acquaintance's own dealings or work with GMO.

This is one privately relayed account, not a recording or a survey of corporate conduct. It does not establish the intrusion's cause.

Still, if a business demands proof of a counterpart's competence, it should demonstrate its own controls after an incident. **Arrogance does not come with two-factor authentication.**

The group's official history spans internet access, finance and games; it did not originate solely in online brokerage. \[3\] My criticism is therefore about the responsibility of an experienced infrastructure group. More business lines create more boundaries to manage. Accountability should scale as quickly as the signage.

## What makes this damage pathway different?

The October 23 disclosure describes malicious software, possible trading-credential compromise and investigation with a security specialist. Its 26,739 figure concerns potentially affected servers, not confirmed victims. \[1\]

The critical analytical chain is a trading cloud environment, compromised access and possible unauthorized activity at external accounts. Exposure of a mailing list and exposure of an environment capable of trading have different consequences.

I have not established that other companies' incidents were internal theft or that only GMO suffered a genuine intrusion. Entry point, privileges, tenant separation and detection timing remain questions for a verified report.

### Investigating the breach is not the same as owning the repair

“Investigating with a security specialist” describes investigative support. It does not identify who built, maintains or operates the system—or who is accountable for restoring it.

A specialist investigating entry paths and exposure does not automatically become the party that understands the design, repairs the application and infrastructure, or restores service. The reviewed disclosures do not establish whether construction was internal or outsourced, who currently maintains it, or who controlled operational privileges and monitoring.

Restoration needs to connect design knowledge and change control, operational implementation and testing, and forensic evidence preservation and validation. Whether the original builder bears every task or cost depends on contracts and causation. GMO, as service provider, still needs to explain who will perform restoration and how it will take responsibility for the result.

**Calling in investigators does not appoint the person who repairs the castle gate. Name the roles: investigator, repair owner, validator and restart decision-maker.**

The label “security specialist” alone establishes neither competence nor independence. Examine scope, prior involvement, methods and deliverables. Unverified credentials warrant neither automatic endorsement nor an unsupported dismissal as merely self-proclaimed.

## Refusing a ransom does not discharge customer responsibility

The company refuses the demand and seeks government measures relating to active cyber defense. \[2\] Its reasoning—that payment cannot ensure deletion or prevent further misuse—is coherent. Refusal alone is not evidence of corporate arrogance.

But firmness toward attackers and practical relief for customers are different jobs. A company request is not government authorization or completed intervention. **The call for national reinforcements must not outrun the explanation owed to customers.**

Customers need clarity on assets, scope, a usable environment and an end to the administrative ordeal—not merely stirring battlefield communiqués.

## How much work sits outside JPY5,000?

The compensation scope concerns recognized incident-related unauthorized-trading realized losses, excluding ordinary market losses, lost profits and indirect damage. \[2\]

The test is fair administration: what happens when the customer cannot access logs? How are disputed findings explained and reconsidered? Can documentation and processing time be reduced? These are questions to investigate, not findings that claims have already been unfairly rejected.

A goodwill payment cannot necessarily buy back time. Free service does not make migration labor free. A fixed payment does not create a fixed workload.

## Invest the goodwill payment tomorrow? The market is closed

Publication falls on Saturday, October 24\. Sunday, October 25 is outside FX Neo's normal trading hours. \[4\] Announcement also does not mean the money has already arrived.

The shared appendix compares seven major currencies and three commonly discussed carry currencies using **invented round-number rates**, not live quotes or forecasts. It ranks none as attractive. The arithmetic shows equal upside and downside for a 1% move. Under these assumptions, JPY5,000 cannot fund even the minimum USD, EUR, GBP or CHF trade; their P/L examples require additional capital.

Even a theoretical maximum 25-times exposure produces only JPY1,250 on a favorable 1% move—and loses the same on an adverse one. Actual lots, costs and margin headroom constrain that theoretical exposure.

**Leverage the goodwill payment all you like; accountability does not become 25 times larger. That upgrade is the company's to fund.**

## If the exchange is to hear criticism, bring a questionnaire

These documents do not establish grounds for delisting. Keep the service operator, listed parent and financial companies distinct.

Ask what the board knew; how much of the root cause will be disclosed; whether independent validation is available; how much compensation is actually paid; and what demonstrates implementation of remediation.

**A listing is not a lifetime warranty on controls. An apology is not a patch.**

The final score should reflect how much of the burden left with customers is removed—not how forcefully management announces its refusal to pay an attacker.

---

[Original Notion archive](https://app.notion.com/p/403bc361ccd281329c86c7a383408ae0?pvs=204&ref=tokyobrainie.ghost.io)