Japan’s GMO Internet Warns Customers to Unplug PCs as Hackers Threaten Ransomware

Japan’s GMO Internet Group urged Onamae.com Desktop Cloud customers to back up their data, disconnect computers from networks, shut them down, and unplug connected cables after suspected attackers threatened to publish customer information and launch ransomware at noon on October 27.

The emergency instructions followed unauthorized access to the company’s cloud desktop service and an extortion demand of approximately ¥8 billion, roughly $50 million.

The warning represented a significant escalation from earlier requests for antivirus scans and password resets.

However, GMO subsequently reported that no ransomware attack had been confirmed as of 13:55 Japan time on October 27.

The distinction matters: the attackers threatened encryption, but the company had not verified that customer computers had actually been encrypted.

Onamae.com Desktop Cloud provides remote desktop environments used by financial traders. GMO suspended the service on October 21 after discovering unauthorized access and received the multibillion-yen ransom demand that day.

It consulted police on October 22 as its investigation expanded to potential customer account abuse and compromised infrastructure.

Reporting identified 26,739 potentially affected virtual desktop servers, although that figure describes infrastructure potentially exposed rather than a confirmed count of infected personal computers or affected individuals.

GMO Researchers said that, the incident extended beyond service availability. Customers reported unauthorized activity involving trading accounts, prompting warnings to change credentials and terminate active sessions.

GMO Internet Faces Ransomware

GMO’s request to disconnect local PCs reflected concern that systems used to access the cloud service might also require investigation. It did not establish that every connecting device was compromised.

The company sought physical access to customer computers to determine whether malware, including ransomware, had been installed.

After an October 25 appeal for cooperation, GMO employees collected customer computers across Japan.

The group’s white hat security team began examining those devices to establish the damage and identify remediation measures.

By 11:59 on October 27, no malware, including ransomware, had been found on devices whose analysis was complete; investigations remained ongoing.

GMO maintained that it would not meet the attackers’ demands, arguing that payment could not guarantee deletion of stolen information or prevent further misuse.

Its response combined police coordination, technical investigation, and direct customer notifications rather than treating ransom payment as a reliable recovery mechanism.

The threat also involved data exposure. On October 27, GMO said suspected attackers had published information appearing to relate to the company and its customers.

That development must remain separate from the ransomware warning: publication of suspected stolen material does not, by itself, demonstrate successful encryption of customer endpoints.

GMO’s customer advisory requested full antivirus scans rather than quick scans and backups of important files while disconnected from networks.

Account protection steps were to be performed from a separate, safe device through official websites, avoiding links delivered through email or SMS.

The company instructed customers to end active sessions, change financial , enable multifactor authentication, and remove unfamiliar linked applications, forwarding rules, extensions, or registered devices. Browser synchronization should remain disabled until checks were complete.

GMO also warned that it would never request passwords or authentication codes, and cautioned against paid “loss recovery” approaches.

GMO separately announced compensation and alternatives, including a ¥5,000 customer payment and reimbursement for unauthorized trading losses.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.