GMO Internet says attackers who breached Onamae.com Desktop Cloud published what they claim is company and customer data on 27 October, after a roughly ¥8 billion ransom demand the company refused. As of 13:55 JST that day, GMO said no ransomware attack had been confirmed, while asking customers to disconnect and power off PCs.
What GMO confirmed
Onamae.com Desktop Cloud is a VPS service operated by GMO Internet, part of GMO Internet Group and one of Japan’s largest domain registrars. In its second report (opens in a new tab) (22 October 2026), GMO said it confirmed on 20 October that a malicious program had been installed in some customer server environments, began suspending servers across all plans on 21 October, and put the number of servers potentially affected at 26,739. Payment card data is not stored on the service’s servers, GMO said, but trading-tool credentials such as MetaTrader 4 and MetaTrader 5 (MT4/MT5) login information held on those servers may have been viewed.
GMO later said it received a threatening email demanding about ¥8 billion and that it would not pay. It offered a flat ¥5,000 sympathy payment to every current customer of the service. In the tenth report (opens in a new tab) (27 October, 13:55 JST), GMO confirmed that at 12:30 that day persons believed to be the attackers had published information they claim relates to the company and its customers. GMO is verifying the content and warned people not to visit or spread the leak site, saying visitors’ information may be collected by the attackers. “As of 13:55 on October 27, no ransomware attack has been confirmed,” the company wrote. “We remain on alert.”
Customer instructions and response
GMO asked customers to run full antivirus scans, back up data, then disconnect from the network, power off and unplug PCs. It is analysing devices taken into custody with help from its white-hat team and partners including Trend Micro, and says it has consulted police. It also warned of phishing, SMS and calls that impersonate GMO or related organisations. BleepingComputer (opens in a new tab) summarised the same sequence: the shut-down advice ahead of the noon deadline, the published data, and GMO’s refusal to pay.
The company’s stated policy is not to comply with the attackers’ demands, on the grounds that payment would not guarantee deletion or stop misuse of stolen information. For customers whose information GMO confirms was published, it says it is deliberating additional payments beyond the flat ¥5,000 already announced.
What to do now
- Onamae Desktop Cloud customers: follow GMO’s published checklist (scan, back up, disconnect, power off). Reset MT4/MT5 and any other credentials that lived on the VPS, from a device that is not the cloud desktop, and check trading histories with brokers.
- Brokers and FX platforms: watch for credential-stuffing and unauthorised trades tied to MT4/MT5 accounts that may have sat on the affected VPS fleet.
- Defenders: treat the leak site as hostile infrastructure; do not browse it. Watch for phishing that cites this incident and asks for passwords or “loss recovery” payments.
Sources
- GMO Internet — Second report on Onamae.com Desktop Cloud unauthorised access (opens in a new tab) (22 October 2026; 26,739 servers; MT4/MT5)
- GMO Internet — Tenth report (opens in a new tab) (27 October 2026, 13:55 JST; published data; no ransomware confirmed)
- GMO Internet — Fourth report (opens in a new tab) (¥5,000 sympathy payment)
- BleepingComputer — Japan’s GMO urges customers to shut down PCs amid ransomware threat (opens in a new tab) (27 October 2026)
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)