Japanese internet giant GMO tells customers to shut down and disconnect PCs from the internet following data breach and ransomware threat
Hackers threatened to install ransomware on user devices, but they never did.
GMO warned customers to back up data, disconnect devices, and shut down systems after a cyberattackAttackers allegedly stole customer data, leaked information, and threatened ransomware deploymentCompromised trading-platform credentials and reports of unauthorized transactions raised concerns for affected users
Japanese internet giant GMO Group has told its customers to scan their computers for viruses, back up all of their data, disconnect the devices from the internet and then shut them down.
The announcement, which literally told customers, “unplug any cords connected to your PC," was made in response to a cyberattack it recently suffered, as well as the threats then made by the malicious actors.
GMO Group gets hit
GMO Internet Group is a large Japanese technology conglomerate whose business spans internet infrastructure, cybersecurity, online advertising, financial services, and more. It brings in billions of dollars every year, and operates a broad portfolio of subsidiaries, among which is Onamae Desktop Cloud, a popular VPS service provider.
Its main customers seem to be individual retail forex (FX) traders in Japan who run automated trading software. It provides a rented Windows desktop hosted on GMO’s servers, allowing customers to keep trading applications running, while being able to shut down their own computers.
On October 20, 2026, the company disclosed having suffered a cyberattack in which threat actors installed malware on some customer environments. Apparently, up to 26,739 servers were at risk, and the company responded by progressively shutting them down, launching an investigation, and cleaning them up.
“We have confirmed that unauthorized access by a third party occurred against Onamae.com Desktop Cloud and that unauthorized programs were installed in some customers’ server environments,” the company said at the time.
The investigation determined that the attackers walked away with sensitive customer data, although it wasn’t said how many customers were compromised, or what types of information were taken. It was also later reported that the unnamed attackers were demanding roughly $50 million in ransom, in exchange for deleting the data. They threatened to release the data on the dark web if the demands aren’t met. Onamae said it wouldn’t pay the attackers, and the data eventually did leak.
Despite the data leaking, no known entities claimed responsibility for the attack.
Condolences money
The attackers also threatened to install ransomware on devices belonging to Onamae customers, triggering the warning and the call for everyone to shut down and unplug their devices:
“1. Request for a full scan of your own device for virus checks 2. Request for backup 3. Request to disconnect network and power from customer PC. Before 12:00 PM on Tuesday, October 27make sure to back up, disconnect the network, turn off the power, and unplug any cords connected to your PC,” the warning, machine-translated from Japanese, reads.
It seems the attackers never acted on their threat, since no ransomware was found on customer servers.
Onamae said it would not pay the attackers, but would instead compensate each customer $30 for their troubles, regardless or not if they actually suffered any damage or not. Those that suffered more meaningful damage will be compensated separately, it was said. Replacement computers were also offered, BleepingComputer reports.
The company has continued its investigation of the attack and is currently analyzing the leaked data to see how many customers were affected, and what is at risk. It also warned the public and the media not to share the leaked information, threatening legal information against those who do.
In one of the updates, Onamae said login credentials and some account details from users of trading platforms MetaTrader 4 and MetaTrader 5 were compromised. “Some customers have reported transactions in their trading accounts that they do not recognize,” it added, before urging customers to reset their passwords and terminate all active sessions.
The full scope of the attack, as well as material damages (which might be substantial), are yet to be seen.
