The GMO Group has advised its clientele to disconnect their systems from the internet and power down computers following a threat actor's breach of the Onamae Desktop Cloud. This actor had threatened to deploy a ransomware attack that same day.
The organization later verified that data pertaining to both the corporation and its clients had been made publicly available online. This alert relates to a cyber incident affecting Onamae Desktop Cloud, a prominent VPS provider in Japan managed by GMO Internet, which is part of the GMO Internet Group and serves as one of Japan's major domain registrars.
Last week, the firm disclosed detecting an intrusion on October 20, which potentially affected servers belonging to up to 26,739 customers. To mitigate risk, the company halted server operations and reduced service availability while an investigation commenced.
The internet company assured clients that payment details remained secure but cautioned that credentials for MetaTrader 4 and MetaTrader 5 (MT4/MT5), along with trading-account specifics, might have been compromised or exposed. Customers were instructed to reset their passwords and end all active sessions.
Subsequent communications from the entity confirmed data theft, noting the attacker demanded a ransom of ¥8 billion ($50 million), a payment GMO stated it would not render. Instead, the company announced a compensation of ¥5,000 ($30) for each customer to address the disruption.
On October 26, GMO issued a warning that threat actors intended to leak customer details online and initiate a ransomware payload planted on customer servers during the intrusion. The following day, the company requested customers unplug all cables, shut down, and disconnect their PCs before noon while collaborating with Trend Micro on recovery efforts.
GMO advised customers: "Once you have a backup, disconnect the network, power it down, and unplug the cord that connects to your PC." The company stated it was scanning customer environments to ascertain if malware persisted and offered equivalent PC replacements for those harmed by a ransomware assault.
In a report issued today, GMO verified the threat actor published corporate and customer data, leading to verification efforts regarding the leaked information's authenticity. For exposed customer data, GMO indicated it would consider further financial recompense.
The attacker seemingly did not execute the threat, as no ransomware was activated on client machines. The company warned the public and media against circulating the exposed details, announcing it would pursue legal action against those who do, while reiterating its stance against paying the attackers.
This incident underscores a broader operational vulnerability: overall prevention scores may obscure post-initial-access activities. When attackers utilize valid credentials, defensive efficacy diminishes sharply. The Blue Report 2026 assesses defenses technique by technique across 338 million simulations conducted within customer production environments.
