"Attackers don’t necessarily need to deploy ransomware to cause significant damage. If they can steal sensitive information, compromise accounts, and threaten to publicly release data, they already have multiple ways to pressure an organization," said Phillip Wylie, chief security evangelist at Suzu Labs.
GMO Internet’s Onamae.com service and the October outage
GMO Internet’s Onamae.com virtual desktop service — delivered via a network the firm says contains tens of thousands of servers and noted in the company’s advisory as popular with foreign‑exchange traders — was suspended on October 21. The company said it discovered the day before that “malicious programs” had been installed in “some customers’ server environments,” prompting the shutdown of the service.
Scale of impact and the ransom demand
A security alert from the company said as many as 26,739 servers may have been impacted. The alert also warned that some information may have been accessed. Some reports suggest the hackers may have accessed trading accounts and made unauthorized transactions, though the firm’s update focused on the server‑side intrusion and its investigation.
On October 21 an extortion email demanded a ransom of around eight billion yen (reported as $50.7m). According to the company statement, GMO Internet refused to pay the ransom. The attackers then notified the firm they would deploy ransomware on October 27 at 12pm.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildGMO Internet’s response: scans, device shipments and customer instructions
Facing a stated October 27 deadline, GMO Internet advised customers to run a full virus scan on their devices, back up all data, and then disconnect their PC from the internet and turn off the power. The firm has been asking customers to ship their PCs so its security team can perform on‑device analysis.
GMO Internet reported that “As of [October 27, 11:59], no malware (including ransomware) has been detected in the devices that have been analyzed.” It added that “the analysis is still ongoing, and we have not yet confirmed the security of all customer devices. More devices from customers are expected to arrive in the future. We will proceed with the analysis as soon as they arrive.”
What this means for foreign‑exchange traders, security teams, and customers
- Foreign‑exchange traders: Onamae.com’s popularity with this group and reports of possible unauthorized trading activity put account integrity and transaction history at the center of immediate concern; traders will be watching forensic results tied to server‑side compromises and any evidence that credentials or session tokens were exfiltrated.
- Security teams and incident responders: The case underscores two stress points Wylie highlighted — preventing the initial compromise and limiting what attackers can do after gaining access. The firm’s insistence on device collection for hands‑on analysis reflects a priority on root‑cause forensic work when remote containment is uncertain.
- Customers and endpoint owners: The firm’s guidance — full virus scan, backups, disconnecting and powering down PCs — was immediate and prescriptive. Customers who ship devices to GMO will be relying on the firm’s stated forensic timeline and the promise that additional arriving devices will be analyzed promptly.
Japan Inc under fire: a broader pattern
GMO’s incident is the latest in a string of security incidents affecting Japanese companies this year. The source lists several major breaches earlier in the year: Burger King (11 million customers), car rental company Times Car (6.6 million), karaoke giant Daiichi Kosho (eight million), and restaurant chain Yakiniku King (11 million). The sequence of high‑profile breaches is the context in which observers and customers will judge both the technical response and the communications from firms that operate at scale.
GMO Internet has taken several clear steps: suspending the Onamae.com service, refusing the extortion demand, advising customers to isolate endpoints, and collecting devices for analysis. As of 11:59 on October 27 the company reported no malware detected in the analyzed devices, but it also stressed that analysis remains incomplete and not all customer devices have been confirmed secure. The public record supplied by the firm leaves a single, concrete question: did the attackers deploy ransomware at the stated 12pm October 27 deadline, and if so, what is the forensics traceable to that action? The company’s ongoing analyses and any subsequent updates will determine whether that question can be answered definitively.
