Japan's GMO urges customers to shut down PCs amid ransomware threat

GMO's Onamae Desktop Cloud suffered an intrusion detected on October 20. The company believed malware could have been installed on as many as 26,739 customer servers. GMO shut down servers, reduced availability, and investigated the breach. Later, it confirmed that company and customer data had been published online.

The shutdown warning was an emergency containment step. GMO told customers to back up their data, disconnect networks, power down computers, and unplug cables. Cutting network access could limit communication with attackers or other systems. Turning off a machine could also stop malicious software from running while systems were checked.

GMO said it was scanning customer systems with help from Trend Micro. It offered equivalent PC replacements to customers whose computers suffered ransomware damage. No ransomware was activated on customer machines, but exposed information still required verification, and GMO warned people not to share it.

Ransomware is malware designed to disrupt access to a computer or its data. It commonly encrypts files, changing them into an unreadable form, and demands money for restoration. It can also stop systems from operating normally. The article refers to a ransomware payload that may have been planted during the intrusion, but it does not describe the payload's exact technical behavior.

If ransomware activates, users may be unable to open important files, run services, or use affected computers. The impact can spread when connected systems share access or network connections. Backups may help restore data, although the article specifically told customers to make a backup before disconnecting their computers.

GMO warned that ransomware could be triggered on customer servers, yet later reporting indicated the attacker never activated it. The company still scanned systems, offered replacement PCs after ransomware damage, and urged customers to disconnect and shut down as a precaution.

The incident potentially affected a very large group of hosted systems. GMO said an intrusion detected on October 20 could have installed malware on up to 26,739 customers' servers. That figure describes possible exposure, not a confirmed infection of every server. GMO shut down servers and reduced service availability while investigating.

The financial demand was also enormous. The threat actor demanded ¥8 billion, stated in the article as $50 million. GMO refused to pay the ransom. Instead, it announced compensation of ¥5,000, or $30, for each customer because of the inconvenience caused by the disruption.

The scale remains important even though the feared ransomware activation apparently did not occur. GMO later confirmed that company and customer data had been published online. It continued verifying the leaked information and said it would consider additional compensation for customers whose information was exposed.

GMO said customers' payment information had not been exposed. However, it warned that MetaTrader 4 and MetaTrader 5 credentials, along with trading-account details, may have been exposed or compromised. These details matter because someone who obtains valid login information may be able to access an account or misuse it.

GMO urged affected customers to reset their passwords and terminate active sessions. Resetting a password replaces a potentially stolen secret. Ending active sessions can sign out devices or connections that may already be using the account. The article does not state that any trading account was actually misused.

GMO later confirmed that company and customer data had been published online and began checking whether the leaked information was authentic. For customers whose information was exposed, the company said it would consider additional financial compensation. It also warned people not to spread the data.

Disconnecting a computer from the internet removes its network connection. That can interrupt communication between malware and an attacker, and it can reduce contact with other connected systems. Shutting the computer down stops its running processes. These actions can therefore help contain a suspected infection while specialists investigate it.

GMO instructed customers to make a backup, disconnect the network, power down the computer, and unplug the cord. The sequence matters because a backup preserves available data, while removing both network and power connections limits the machine's activity. The article does not claim these steps guarantee that malware is removed.

The warning followed GMO's report that a ransomware payload might have been planted on customer servers. GMO worked with Trend Micro to recover from the attack and scanned systems for remaining malware. No ransomware was activated on customer machines, but the shutdown order was intended to reduce that risk.

GMO Internet operated Onamae Desktop Cloud, a popular VPS provider in Japan. Its customers used servers supplied through that service. GMO detected the intrusion, shut down servers, reduced availability, investigated the event, warned customers, and later confirmed that data had been published online.

The customers were told to back up data, disconnect networks, shut down computers, and reset potentially exposed credentials. Trend Micro worked with GMO to recover from the cyberattack and helped with system scanning. The threat actor was the intruder who demanded ¥8 billion, threatened to trigger ransomware, and published company and customer data.

GMO refused to pay and offered ¥5,000 to each customer for inconvenience. It said additional compensation might be considered for customers whose information was exposed. The article indicates that the attacker did not activate ransomware, although the data leak and possible credential exposure remained serious concerns.

A cloud or VPS provider manages infrastructure used by many customers. Shared management tools, networks, storage, or administrative controls can create common points of risk. If an attacker reaches one such control, the intrusion may affect more than one hosted environment. The article does not identify the precise technical route used in GMO's breach.

In this incident, GMO said malware could have been installed on up to 26,739 customers' servers after an intrusion into Onamae Desktop Cloud. That example shows why a provider-side compromise can create a broad warning. GMO shut down servers and reduced service availability while investigating, rather than treating the event as an isolated customer problem.

The potential reach made coordinated action necessary. Customers were told to back up, disconnect, shut down, and unplug computers. GMO scanned systems and worked with Trend Micro. Even without ransomware activation, the published company and customer data showed that a shared service can concentrate risk.