Japan’s GMO Group orders emergency PC shutdowns amid an $50 million ransomware threat
On October 27, GMO Internet Group urged its customers to disconnect their personal computers from the internet, power them down, and unplug all network cables before noon. The drastic advisory followed a cyberattack on the company’s Onamae Desktop Cloud service, in which threat actors stole company and customer data and demanded an ¥8 billion ransom.
Intusion detection and the Onamae Desktop Cloud breach
The security incident began earlier. An intrusion was identified by GMO Internet Group on October 20, which had the potential to place malware onto as many as 26,739 servers belonging to customers. To contain the breach, the company shut down the servers and reduced service availability while launching an investigation alongside cybersecurity firm Trend Micro.
UPDATE: GMO says Onamae Desktop Cloud breach may have exposed trading-account loginsGMO Internet says information stored on compromised customer servers, including trading-account logins saved in trading tools, may have been taken and misused.* Customers have reported… pic.twitter.com/Qx0CdVO6Sf
While payment information remained uncompromised, the company warned that credentials and trading-account details for MetaTrader 4 and MetaTrader 5 (MT4/MT5) might have been exposed or compromised. GMO advised affected users to reset passwords and terminate all active sessions immediately.
The ¥8 billion extortion demand and data leaks
The attackers demanded an ¥8 billion ransom—equivalent to $50 million—which GMO said it would not pay. Instead, the company announced it would compensate each customer ¥5,000 ($30) for the inconvenience caused.
A warning was issued by GMO on October 26 indicating that malicious actors intended to publish customer details online and activate ransomware that had been deposited on customer servers earlier in the campaign. On October 27, GMO confirmed that the threat actor had published company and customer data on the internet.
System recovery and compensation plans
The company confirmed that the attacker never acted on their threat, as no ransomware was activated on customer machines. The company said it was scanning customer systems to determine whether malware was still present.
To address the fallout, GMO said it will consider additional financial compensation for individuals whose information was exposed. Furthermore, the company offered equivalent PC replacements to those who suffered damages from a ransomware attack while threatening legal action against anyone disseminating the stolen data.
