Japanese internet giant GMO tells customers to shut down and disconnect PCs from the internet following data breach and ransomware threat

Date:
Wed, 28 Oct 2026 12:15:00 +0000

Description:
Hackers threatened to install ransomware on user devices, but they never did.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter GMO warned customers to back up data, disconnect devices, and shut down systems after a cyberattack Attackers allegedly stole customer data, leaked information, and threatened ransomware deployment Compromised trading-platform credentials and reports of unauthorized transactions raised concerns for affected users Japanese
internet giant GMO Group has told its customers to scan their computers for viruses, back up all of their data, disconnect the devices from the internet and then shut them down.

The announcement, which literally told customers, unplug any cords connected to your PC," was made in response to a cyberattack it recently suffered, as well as the threats then made by the malicious actors. GMO Group gets hit GMO Internet Group is a large Japanese technology conglomerate whose business spans internet infrastructure, cybersecurity, online advertising, financial services, and more. It brings in billions of dollars every year, and operates a broad portfolio of subsidiaries, among which is Onamae Desktop Cloud, a popular VPS service provider. Latest Videos From TechRadar Watch full video here:

Its main customers seem to be individual retail forex (FX) traders in Japan who run automated trading software. It provides a rented Windows desktop hosted on GMOs servers, allowing customers to keep trading applications running, while being able to shut down their own computers.

On October 20, 2026, the company disclosed having suffered a cyberattack in which threat actors installed malware on some customer environments. Apparently, up to 26,739 servers were at risk, and the company responded by progressively shutting them down, launching an investigation, and cleaning them up. You may like Ahold Delhaize takes systems offline after cyberattack global retail giant says 'cybersecurity incident' hit systems, but stores remain open Kiteworks tells users to shut down servers amid fears of 'imminent' cyberattack ShinyHunters hackers claim to have hit data center provider used by Microsoft and Meta

We have confirmed that unauthorized access by a third party occurred against Onamae.com Desktop Cloud and that unauthorized programs were installed in
some customers server environments, the company said at the time.

The investigation determined that the attackers walked away with sensitive customer data, although it wasnt said how many customers were compromised, or what types of information were taken. It was also later reported that the unnamed attackers were demanding roughly $50 million in ransom, in exchange for deleting the data. They threatened to release the data on the dark web if the demands arent met. Onamae said it wouldnt pay the attackers, and the data eventually did leak. Are you a pro? Subscribe to our newsletter Sign up to
the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over.

Despite the data leaking, no known entities claimed responsibility for the attack. Condolences money The attackers also threatened to install ransomware on devices belonging to Onamae customers, triggering the warning and the call for everyone to shut down and unplug their devices:

1. Request for a full scan of your own device for virus checks 2. Request for backup 3. Request to disconnect network and power from customer PC. Before 12:00 PM on Tuesday, October 27make sure to back up, disconnect the network, turn off the power, and unplug any cords connected to your PC, the warning, machine-translated from Japanese, reads. What to read next Over 8.7 million karaoke fans at risk after major data breach Japanese giant Nippon Columbia says malware infection was to blame for exposing records Hackers turn
business backup servers into crypto mines after sneaking malware disguised as Microsoft Edge Scammers pose as ransomware recovery agents, but just go on to steal more from victims

It seems the attackers never acted on their threat, since no ransomware was found on customer servers.

Onamae said it would not pay the attackers, but would instead compensate each customer $30 for their troubles, regardless or not if they actually suffered any damage or not. Those that suffered more meaningful damage will be compensated separately, it was said. Replacement computers were also offered, BleepingComputer reports.

The company has continued its investigation of the attack and is currently analyzing the leaked data to see how many customers were affected, and what
is at risk. It also warned the public and the media not to share the leaked information, threatening legal information against those who do.

In one of the updates, Onamae said login credentials and some account details from users of trading platforms MetaTrader 4 and MetaTrader 5 were compromised. Some customers have reported transactions in their trading accounts that they do not recognize, it added, before urging customers to reset their passwords and terminate all active sessions.

The full scope of the attack, as well as material damages (which might be substantial), are yet to be seen.

Via BleepingComputer The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/japanese-internet-giant-gmo-tells-custo mers-to-shut-down-and-disconnect-pcs-from-the-internet-following-data-breach-a nd-ransomware-threat


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)