Japanese internet company GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae Desktop Cloud service, which provides virtualized desktops to financial traders. GMO said on its blog that it believes the attacker has published information allegedly linked to customers and its business, but the contents are still being verified and the full extent remains unclear. The company has advised customers to reset passwords after receiving reports of “unauthorized operations” performed on customer trading accounts, and said 27,000 servers may be affected. A GMO spokesperson did not respond to TechCrunch’s request for comment.

The breach comes about a week after GMO’s cybersecurity unit reported evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan. GMO has not publicly established a connection between Artex and the Onamae breach. CrowdStrike reported earlier this month that Artex was used to hack financial institutions in South Korea in September, with attacks largely exploiting weak security controls such as lack of multi-factor authentication. Reuters reported that Artex’s Chinese developer has stopped public updates and made the tool closed-source after it was linked to cyberattacks targeting banks.

Separately, Japan’s Financial Service Agency issued guidance in May urging financial institutions to prepare for a rise in cybersecurity vulnerabilities. The regulator called for stronger basic defenses, including “vulnerability management, defense-in-depth and incident preparedness,” while encouraging firms to use AI and other security tools, according to a spokesperson.

Here is the incident timeline: On Oct 21, GMO shut down Onamae Desktop Cloud after discovering unauthorized access, and received an email from hackers demanding about 8 billion yen (~$50 million). On Oct 22, GMO reported the incident to Japanese police. On Oct 24, it said it would offer customers compensation and alternative service while seeking help from government agencies. On Oct 25-26, it began collecting devices from customers to detect malware and understand damage. On Oct 27, GMO said a suspected attacker had posted information that appeared to be linked to the company and customers, and it was still checking whether the information was genuine.