GMO Internet emergency notices October 27, 2026; status update at 13:55 on October 27, 2026
GMO Internet Told Customers to Unplug Before Noon: A $50 Million Ransomware Threat in Japan
Japan's GMO Internet Group told users of its Onamae.com Desktop Cloud service that suspected attackers had warned they would release customer information and launch a ransomware attack at 12:00 on Tuesday, October 27, and instructed customers to run a full virus scan, back up their data, disconnect from the network, shut down, and unplug cables before the deadline. The warning followed an earlier disclosure of unauthorized access to the Onamae.com remote desktop platform that breached customer data and enabled unauthorized foreign exchange trades, which GMO said it would reimburse. Outlets including Investing.com, Rescana, and The Cyber Express reported a demand of US$50 million, and GMO said it would not accept or comply with the demand. In a status update at 13:55 on October 27, after the deadline passed, GMO wrote that no ransomware attack had been confirmed at that time. No outlet in the verified reporting names the attacking group, and the exact volume and type of data taken have not been published.
Executives
A provider told paying customers to pull the plug on a clock set by the attacker. That is what an extortion deadline looks like when the intrusion and the data theft have already happened: the remaining decisions are refusal, reimbursement, and how clearly you communicate. Decide your own ransom position and your customer notification sequence before an attacker sets your deadline for you.
CIO / CISO
Treat hosted desktops as tenant infrastructure, not as a vendor problem that ends at the contract. Ask any hosted desktop or remote access provider how tenants are isolated, where credentials are stored, and what its numbered public update practice looks like, because GMO was on its eighth and ninth incident reports by October 27. For your own users on such services, the sequence matters: scan first, back up offline, then disconnect.
Engineers
A powered-off machine cannot encrypt, receive commands, or move laterally, but shutdown does not remove persistence or undo theft that already occurred. Bring affected endpoints back only on an isolated segment, scan before reconnecting, and rotate brokerage, email, and other credentials that were typed into or stored on the hosted environment, starting with financial logins.
Everyone (non-IT)
If you use a hosted desktop for trading or work, follow the provider's official notices first, change passwords for accounts you used there, and turn on multifactor authentication on financial accounts, preferring app-based or hardware methods over text messages. Do not download or share files that claim to be leaked data from the incident, because leak archives are a common way to deliver malware.