GMO Internet urges Japanese customers to shut down PCs amid ransomware threat

Summary

Japan’s GMO Internet Group has warned its customers to disconnect from the internet, power‑off their PCs and unplug cables after a threat actor claimed to have planted ransomware on the Onamae Desktop Cloud VPS service.

Confirmed facts

• On Oct 20 GMO detected an intrusion that may have installed malware on up to 26,739 customer servers.
• The attacker later published company and customer data online and demanded a ransom of ¥8 billion (≈ $50 million). GMO said it will not pay.
• GMO is offering a ¥5,000 (≈ $30) compensation to each affected customer and, where damage is proven, a replacement PC.
• The company is working with Trend Micro to scan systems and verify whether the ransomware payload was ever activated – no evidence of a live attack has been found.

Reported claims and unknowns

• GMO warned that the stolen data includes MetaTrader 4/5 credentials and trading‑account details; it advises password resets and termination of active sessions.
• The firm says payment‑card information was not exposed, but it cannot confirm that all other personal data are safe.
• It remains unclear how many customers actually suffered data loss or system damage beyond the initial intrusion.

Practical steps for customers

1. Back up any important files to an offline medium.
2. Disconnect the PC from the network, shut it down and unplug the power cord.
3. Reset passwords for all accounts, especially MT4/MT5 and any trading platforms.
4. Monitor email and banking statements for suspicious activity.
5. Contact GMO support for verification of compromised data and to request the ¥5,000 compensation.

How to verify the announcement

• Check GMO’s official blog or press release page (URL ends with */news*).
• Look for statements from Trend Micro confirming joint investigation.
• Verify the ransom demand and compensation figures in reputable Japanese tech news outlets (e.g., *Nikkei* or *ITmedia*).

Implications

The incident highlights the risk of unmanaged VPS environments and the importance of rapid isolation when a breach is suspected. Enterprises using GMO’s cloud services should review their incident‑response plans and consider multi‑factor authentication for trading‑platform credentials.

--- *This article is based on publicly available statements from GMO Internet and does not contain original reporting.*