26,739 customers' servers were potentially affected after GMO Internet detected an intrusion on October 20 that “could have installed malware” across its Onamae Desktop Cloud virtual private server environment, the company said — a breach that has since led to published data, a large ransom demand, and an urgent customer shutdown advisory.
Onamae Desktop Cloud intrusion and immediate containment
GMO Internet — a member of the GMO Internet Group and operator of the Onamae Desktop Cloud VPS service — disclosed it detected an intrusion on October 20 and moved quickly to shut down the affected servers and reduce service availability while investigators worked to determine impact. The company said the incident could have installed malware on up to 26,739 customer servers and that it subsequently launched an investigation.
Data published and a ¥8 billion ransom demand
Subsequent updates confirmed that data belonging to both GMO and its customers had been published online. The threat actor behind the intrusion demanded ¥8 billion (reported as $50 million), a demand GMO said it would not meet. GMO announced it will provide ¥5,000 (about $30) to each customer for the inconvenience; for customers whose information was exposed, the company said it would “consider additional financial compensation.”
In a report published earlier today, GMO confirmed the attacker had posted company and customer data and said it was in the process of verifying the authenticity of the leaked information. The company also emphasized that, to date, it had not paid the ransom and reaffirmed its refusal to do so.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageCustomer-facing instructions and protections
GMO advised customers that payment information had not been exposed, but warned that MetaTrader 4 and MetaTrader 5 (MT4/MT5) credentials and trading-account details “may have been exposed or compromised.” The company urged customers to reset passwords and terminate active sessions for trading services.
Facing a threat the company said included plans to both leak customer information and trigger a ransomware payload planted earlier in the attack, GMO issued a stark operational directive: it asked customers to disconnect their PCs from the internet, shut them down, and unplug all cables before noon the following day. “Once you have a backup, disconnect the network, power it down, and unplug the cord that connects to your PC,” GMO advised.
Recovery actions, scanning and third-party help
GMO said it was scanning customer systems to determine whether malware remained and was working with security vendor Trend Micro on recovery. The company offered equivalent PC replacements to customers who suffered damage from a ransomware attack, and said it planned to compensate affected customers financially where appropriate.
Despite the attacker’s threat to activate ransomware on customer machines, GMO reported that it appears the attacker never triggered a ransomware payload — “no ransomware was activated on customer machines,” the company said — even as data was published online.
How MT4/MT5 traders, exposed customers, and the media are responding
- MT4/MT5 traders: Those using MT4/MT5 were specifically warned that trading credentials and account details may have been compromised, and GMO instructed them to reset passwords and terminate active sessions to reduce credential-based access risks.
- Customers with exposed data: GMO pledged to verify the authenticity of published information and to consider additional financial compensation for customers whose personal information was confirmed exposed; it also offered hardware replacements for ransomware damage.
- The media and the public: GMO warned people and the media not to disseminate the exposed information and announced it will take legal action against those who do so, while publicly refusing to accede to the ransom demand.
For defenders, GMO pointed to a harsh reality: once attackers have valid credentials, prevention drops sharply. The source included a note about the Blue Report 2026, which “measures defenses technique by technique across 338 million simulations run in customer production environments,” underscoring that prevention metrics can obscure what happens after initial access is achieved.
The incident leaves several concrete traces: an October 20 detection that prompted shutdowns, a published data set confirmed today, an ¥8 billion demand refused by the company, and a customer shutdown directive aimed at preventing a threatened ransomware activation that, according to GMO, was not ultimately executed. GMO’s next steps — verifying leaked data, scanning customer systems with Trend Micro, and determining additional compensation where appropriate — will be the immediate barometer of whether this containment effort succeeds.
