NEWS

Japan's GMO Urges Customers to Shut Down PCs Amid Ransomware Threat

GMO Internet told Onamae Desktop Cloud customers to power off systems after an intruder stole data, demanded ¥8 billion and threatened a ransomware payload.

Dylan H.

News Desk

October 27, 2026
2 min read
Japan's GMO Urges Customers to Shut Down PCs Amid Ransomware Threat

Summary

The GMO Group has asked customers of its Onamae Desktop Cloud VPS service to disconnect from the internet and shut down their machines. An attacker who breached the service has threatened to trigger a ransomware payload and leak stolen data. Onamae Desktop Cloud is operated by GMO Internet, one of Japan's largest domain registrars.

Timeline

  • October 20: An intrusion occurred that could have placed malware on up to 26,739 customer servers. GMO shut down servers and reduced service availability while investigating.
  • October 24: GMO confirmed data theft. The attacker demanded ¥8 billion (about $50 million), which GMO refused to pay. It announced ¥5,000 (about $30) in compensation per customer.
  • October 26: GMO warned that the attacker planned to leak customer data and activate a ransomware payload planted on customer servers.
  • October 27: GMO asked customers to shut down and unplug their PCs before noon, and said it was working with Trend Micro on recovery. The attacker published company and customer data, which GMO began verifying.

Impact

  • Company and customer data was published by the attacker.
  • MetaTrader 4 / 5 (MT4/MT5) credentials and trading-account details may have been exposed.
  • GMO says payment information was not exposed.
  • The threat actor has not been named. No ransomware appears to have activated on customer machines so far.

GMO's Response

GMO is scanning customer systems for remaining malware and offering equivalent replacement PCs to customers whose systems were damaged. It is considering additional compensation for people whose information was exposed, reaffirmed that it will not pay the ransom, and asked the public and media not to spread the leaked data, warning of legal action.

Recommendations

  1. Customers should back up data, disconnect from the network, and power down affected desktops as GMO instructed.
  2. Reset passwords and terminate active sessions, especially for MT4/MT5 trading accounts.
  3. Treat any restored or replacement system as untrusted until scanned.
  4. Expect phishing that references the incident and verify messages through official GMO channels.
  5. Organizations using hosted desktop services should confirm they can isolate and rebuild instances quickly.

Sources