GMO Internet Urges Customers to Disconnect PCs Amid Ransomware Threat
Japanese internet service provider GMO Internet has advised its customers to disconnect their PCs due to a potential ransomware attack, with attackers demanding a significant ransom.
GMO Internet's Onamae.com service, a popular platform for foreign-exchange traders, has been targeted by hackers. The company discovered on October 20 that "malicious programs" had been installed in "some customers' server environments," leading to a suspension of the service the following day. The breach potentially impacted up to 26,739 servers, with reports suggesting unauthorized transactions may have occurred in compromised trading accounts.
Following the discovery, the attackers sent an extortion email on October 21, demanding a ransom of approximately eight billion yen (around $50.7 million USD). GMO Internet has refused to pay the ransom. In response, the attackers notified the company that they intended to deploy ransomware on October 27 at 12 PM.
In light of the imminent threat, GMO Internet issued a strong advisory to its customers. They were urged to perform a full virus scan on their devices, back up all critical data, and then immediately disconnect their PCs from the internet and power them off. This drastic measure aims to prevent the potential spread of ransomware and further data compromise.
As part of the investigation and remediation efforts, GMO Internet has requested customers to ship their PCs to the company's security team for analysis. As of October 27, 11:59 AM, the company stated that no malware, including ransomware, had been detected in the devices analyzed so far. However, the analysis is ongoing, and the security of all customer devices has not yet been confirmed.
This incident highlights the significant consequences that can arise from vulnerabilities in remote access services. Phillip Wylie, chief security evangelist at Suzu Labs, commented that attackers can inflict substantial damage without necessarily deploying ransomware, by simply stealing sensitive information, compromising accounts, or threatening data leaks. He emphasized the critical importance of not only preventing initial compromises but also limiting the attackers' lateral movement and impact once access is gained.
The breach at GMO Internet is the latest in a series of high-profile cybersecurity incidents affecting Japanese firms in 2026. Previous attacks have impacted a wide range of organizations, including Burger King, Times Car, Daiichi Kosho, and Yakiniku King, underscoring a growing trend of cyber threats targeting businesses in Japan.