Japanese internet giant GMO is asking its customers to shut down and disconnect their PCs from the internet following a data breach and ransomware threat.
follow us
Add us as a preferred source on Google
- GMO warned customers to back up data, unplug devices and shut down systems after cyberattack
- Attackers allegedly stole customer data, leaked information and threatened to deploy ransomware
- Compromised trading platform credentials and reports of unauthorized transactions raised concerns among affected users.
Japanese Internet giant GMO Group has told its customers to scan their computers for viruses, back up all their data, disconnect devices from the Internet and then turn them off.
The announcement, which literally told customers to “disconnect all cables connected to your PC,” was made in response to a recent cyberattack it suffered, as well as threats made by malicious actors.
The GMO group is affected
GMO Internet Group is a large Japanese technology conglomerate whose business spans internet infrastructure, cybersecurity, online advertising, financial services, and more. It generates billions of dollars each year and operates a broad portfolio of subsidiaries, including Onamae Desktop Cloud, a popular VPS service provider.
Latest videos ofTechnologyRadar
Their main customers appear to be individual retail foreign exchange (FX) traders in Japan running automated trading software. It provides a rented Windows desktop hosted on GMO’s servers, allowing customers to keep business applications running while also shutting down their own computers.
On October 20, 2026, the company disclosed that it suffered a cyberattack in which threat actors installed malware in some customer environments. Up to 26,739 servers were reportedly at risk, and the company responded by progressively shutting them down, launching an investigation, and cleaning them up.
“We have confirmed that unauthorized access by a third party to Onamae.com Desktop Cloud occurred and that unauthorized programs were installed on some customers’ server environments,” the company said at the time.
The investigation determined that the attackers took sensitive customer data, although it was not said how many customers were compromised or what type of information was taken. It was also later reported that the anonymous attackers were demanding approximately $50 million in ransom in exchange for deleting the data. They threaten to publish the data on the dark web if the demands are not met. Onamae said he would not pay the attackers and the data was eventually leaked.
Despite the data breach, no known entity claimed responsibility for the attack.
condolence money
The attackers also threatened to install ransomware on devices belonging to Onamae customers, prompting the warning and a call for everyone to turn off and unplug their devices:
“1. Request a full scan of your own device for viruses 2. Request a backup 3. Request to disconnect the network and power of the client PC. Before 12:00 pm on Tuesday, October 27, be sure to make a backup, disconnect the network, turn off the power, and disconnect all cables connected to your PC,” reads the warning, automatically translated from Japanese.
It appears that the attackers never acted on their threat, as no ransomware was found on customer servers.
Onamae said it would not pay the attackers, but would instead compensate each customer $30 for their trouble, regardless of whether they actually suffered any harm or not. Those who suffered more significant damage will be compensated separately, it was said. Spare computers were also offered, beepcomputer information.
The company has continued its investigation of the attack and is currently analyzing the leaked data to see how many customers were affected and what is at risk. He also warned the public and media not to share the leaked information, threatening legal information against those who did.
In one of the updates, Onamae said that the login credentials and some account details of users of the MetaTrader 4 and MetaTrader 5 trading platforms were compromised. “Some customers have reported transactions on their trading accounts that they do not recognize,” he added, before urging customers to reset their passwords and end all active sessions.
The full extent of the attack remains to be seen, as does the property damage (which could be substantial).
Through beepcomputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment