Japan’s GMO Internet Group has confirmed that company and customer data stolen in a cyberattack on its Onamae Desktop Cloud service has been published online, escalating an incident that prompted urgent warnings for customers to disconnect their computers from the internet and shut them down.
The attack targeted Onamae Desktop Cloud, a virtual private server (VPS) service operated by GMO Internet. The company first detected the intrusion on October 20 and warned that as many as 26,739 customer servers could have been affected by malware installed during the breach.
Following the discovery, GMO shut down affected servers and restricted service availability while investigating the incident. The company initially said payment information had not been exposed but warned that MetaTrader 4 and MetaTrader 5 credentials and trading account details might have been compromised. Customers were advised to reset their passwords and terminate active sessions as a precaution.
The incident escalated when the attackers allegedly demanded a ransom of ¥8 billion, equivalent to approximately $50 million. GMO refused to pay and announced that it would provide affected customers with ¥5,000, or around $30, in compensation for the inconvenience caused.
On October 26, the company warned that the attackers planned to publish stolen information and activate ransomware previously planted on customer systems. The following day, GMO issued an urgent advisory instructing customers to disconnect their computers from the internet, shut them down and unplug their network cables before noon. The company also worked with cybersecurity firm Trend Micro to investigate the incident and support recovery efforts.
GMO said it was scanning customer systems to determine whether malware remained present. It also offered replacement computers to customers whose systems suffered damage from a ransomware attack.
In a subsequent update, the company confirmed that information belonging to both GMO and its customers had been published online. The company said it was working to verify the authenticity of the exposed data and would consider additional compensation for customers whose information was affected.
Although the attackers had threatened to activate ransomware, GMO’s updates indicated that the threatened activation had not occurred on customer computers at the time of reporting.
The company has also warned the public and media organisations against redistributing the leaked information, stating that it may pursue legal action against those who disseminate the material. GMO reiterated that it would not pay the ransom demanded by the attackers.
The incident highlights the risks associated with compromised cloud infrastructure, particularly when attackers can potentially access multiple customer environments through a single service provider. For affected users, the immediate priorities include following official recovery instructions, changing potentially exposed credentials and checking systems for signs of compromise.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
