GMO Internet receives extortion threats, urges customers to disconnect and shut down their PCs before 12:00 on October 27
On October 27, 2026, GMO Internet issued Report No. 9, saying it had received notice from the attacker that customer information would be made public and a ransomware attack carried out at 12:00 that day. The company again asked users of “Onamae.com Desktop Cloud” to complete a full-virus scan and data backup before that time, disconnect from the network, turn off the power, and unplug all connected cables. The company said it would not respond to the attacker’s monetary demands because payment cannot guarantee that information will be deleted or prevent misuse, and that it is cooperating with the police.
The incident began when it was confirmed on October 20 that a third party had installed malicious programs in some customers’ server environments, and the service was suspended from October 21. About 26,739 servers may have been affected, and information such as customers’ trading account login details may have been obtained, with some users reporting unauthorized transactions. As of 11:59 on October 27, no malware such as ransomware had been found in customer devices that had already been analyzed, and analysis is continuing. The company has announced that it will pay all users a 5,000 yen goodwill payment, compensate losses from unauthorized transactions, and provide customers affected by ransomware with new PCs of equivalent performance.
Desktop Cloud is a cloud-based Windows desktop service for automated trading in foreign exchange and other markets. The attacker threatened to publish information about customers’ connected PCs and deploy ransomware against them. The company stated in the report that it would not ask for passwords or authentication codes, and reminded users not to respond to any contact requesting payment.
Original sources:
Title: [Important] Current Response to Unauthorized Access to “Onamae.com Desktop Cloud” (Ninth Report) Publisher: GMO Internet, Inc. Publication date: 2026-10-27 URL: https://internet.gmo/en/news/article/255/ Source nature: official announcement Verification status: this time the report content was actually read, verification date 2026-10-26 Supporting content: notice of public release of customer information and ransomware attack at 12:00, request for customers to scan/back up/disconnect from the network and turn off power, no malware found in analyzed devices as of 11:59, no ransom payment, timeline.
Title: Japanese company to compensate users hit by cyberattack Publisher: Euronews Publication date: 2026-10-26 URL: https://www.euronews.com/2026/10/26/japanese-company-to-compensate-users-hit-by-cyberattack Source nature: media report Verification status: relevant passages were actually read this time, verification date 2026-10-26 Supporting content: potential impact on 26,739 servers, customer information taken out, unauthorized transactions, refusal to pay ransom (the CEO mentioned a demand for about $50 million in cryptocurrency), 5,000 yen goodwill payment and loss compensation.
Title: [Important] Notice and Apology Regarding Unauthorized Access to “Onamae.com Desktop Cloud” (Fourth Report) Publisher: GMO Internet, Inc. Publication date: 2026-10-24 URL: https://internet.gmo/en/news/article/249 Source nature: official announcement Verification status: this was actually read this time, verification date 2026-10-26 Supporting content: confirmation of system vulnerabilities, unauthorized access, and customer information being taken out; the attacker’s monetary demands and threats (ongoing unauthorized transaction operations, publication of customer PC information and deployment of ransomware, publication of company information).
ABAB AI Insight
The core of this incident is that after the cloud virtual desktop (VDI) environment was breached, the attacker extended the threat to customers’ local PCs. Desktop Cloud is used to run automated foreign exchange trading tools, and server-side login credentials may have been obtained, leading to unauthorized account operations; at the same time, the attacker claimed to have information about customers’ connected PCs and could remotely deploy ransomware. GMO suspended the service on October 21 and gradually shut down servers, but it cannot directly control customers’ local devices, so it can only use announcements to ask users to disconnect from the network and turn off the power themselves. Batch remote shutdown is technically infeasible, and with the service already stopped, client isolation has become the main mitigation measure.
On the business side, the company refused to pay the ransom (with public reports saying the CEO mentioned the attacker demanded about $50 million in cryptocurrency), on the grounds that payment cannot guarantee information deletion. The compensation plan includes a 5,000 yen goodwill payment for all users, compensation for losses from unauthorized transactions, and new PCs for those affected by ransomware. Potential impact involves trading accounts with more than 70 domestic and overseas brokers/foreign exchange firms, widening the risk exposure. The CEO has called for Japan to adopt proactive cyber defense measures.
Compared with other cloud-service data leaks, the special feature here is that the service is aimed at high-value financial trading scenarios, and the threat has expanded from server data to client devices. The similarity is that threats escalate after refusal to pay; the difference is that customers must actively power off their devices rather than simply change passwords. On the capital side, the event has affected the company’s share price and exposed security weaknesses in remote desktop and trading-tool credential storage.
This incident changes the assumption in cloud trading environments that “server-side isolation is enough”: the attacker can make client devices a secondary target. The key indicators to watch are whether there are actual cases of customer PC encryption or information leakage after 12:00, and the company’s continuing reports on already analyzed devices and newly received devices; if large-scale encryption does not occur, it may be related to customer response rates or the attacker’s actual capabilities.
ABAB News · Laws of cognition
Even after cloud services are suspended, threats can still extend to customers’ local PCs, requiring users to isolate them proactively.
After refusal to pay, threats escalate into public disclosure and ransomware, and compensation becomes post-incident relief.
The combination of trading credentials and remote desktops expands the attack surface, creating a continuous risk from server to client.