GMO Internet warns users to power down machines following cloud breach and extortion attempt

Japanese tech firm GMO Internet warned customers to disconnect and shut down their computers after attackers breached its Onamae Desktop Cloud service and demanded an 8 billion yen ($50 million) ransom. GMO refused to pay the extortionists, who threatened to detonate ransomware across customer systems. The provider shut down servers to contain the damage, affecting up to 27,000 virtual private servers primarily used by financial traders. [1][2]

The attackers subsequently published stolen corporate and customer data online, which GMO is still verifying. While payment information was not compromised, the company cautioned that MetaTrader 4 and MetaTrader 5 trading-account credentials may have been exposed, prompting reports of unauthorized account operations. Customers were instructed to back up files, unplug network cables and power cords, and reset their credentials while GMO collaborated with Trend Micro on remediation. [1][2]

The ransomware payload was ultimately never triggered on customer devices. GMO has offered 5,000 yen ($30) in initial compensation to each affected customer, along with replacement hardware for damaged systems and potential additional payments for those with leaked data. The attack follows broader warnings from Japan's Financial Services Agency advising financial institutions to strengthen foundational cybersecurity defenses. [1][2]