GoKawiilGMO Internet tells customers to shut down PCs as ransomware threat materializes
GMO Internet Group has urged users of its Onamae Desktop Cloud VPS service to disconnect from the internet, power down their PCs, and unplug cables after attackers who breached the service followed through on threats to leak stolen data and trigger ransomware. The breach, first detected on October 20, may have affected up to 26,739 customer servers, exposing MetaTrader 4/5 trading credentials though not payment data. GMO says it refused the attacker's ¥8 billion ($50 million) ransom demand and is instead offering each affected customer ¥5,000 ($30) in compensation while working with Trend Micro on recovery.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows how a breach at a single VPS provider can cascade into thousands of individual customer compromises, forcing an unusual real-time emergency response of mass PC shutdowns rather than a standard patch-and-notify process. GMO's refusal to pay the ransom, paired with a modest flat compensation offer, suggests the company is betting that reputational and financial costs of paying extortion would outweigh customer goodwill lost from a limited payout. The exposure of trading platform credentials also raises risk of downstream financial fraud for affected customers beyond the immediate ransomware threat.
- GMO's Onamae Desktop Cloud breach may have affected up to 26,739 customer servers.
- Attackers demanded ¥8 billion ($50M); GMO refused and offered customers ¥5,000 each instead.
- GMO told customers to disconnect, power down, and unplug PCs as leaked data and ransomware payloads were triggered.
YubiKey 5 NFC Security Key — With credential theft and ransomware threats like this GMO breach hitting cloud and trading accounts, hardware-based two-factor authentication is one of the strongest defenses against account takeover. A YubiKey lets you secure logins, password managers, and sensitive trading or server accounts so stolen passwords alone can't grant access. It's a practical step any reader managing cloud servers or financial accounts should consider right now.”, I'll shorten appropriately.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-27
Published there as: “Japan's GMO urges customers to shut down PCs amid ransomware threat”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.