GMO Tells Customers to Shut Down and Disconnect PCs Following Data Breach and Ransomware Threat

Japanese technology conglomerate GMO Group told its customers to back up their data, scan their computers for viruses, disconnect their devices from the internet, and shut them down. The warning followed a cyberattack on the company's virtual private server service, Onamae Desktop Cloud.

The attack took place on October 20, 2026, when unauthorized third parties gained access to Onamae and installed malware in some customer environments. Up to 26,739 servers were at risk, prompting the company to progressively shut them down, launch an investigation, and clean them up. Investigators determined that sensitive customer data was stolen during the breach.

The unnamed attackers later demanded roughly $50 million in ransom to delete the stolen information and threatened to release it on the dark web if their demands were not met. Onamae refused to pay, and the data was subsequently leaked. Despite the leak, no known groups have claimed responsibility.

The situation escalated when the hackers threatened to install ransomware on the personal devices of Onamae customers. This threat prompted the urgent advisory telling users to unplug all cords connected to their personal computers. However, the company reported that the attackers never acted on that specific threat, and no ransomware was found on customer servers.

To address the incident, Onamae announced it would compensate each customer $30 for their trouble, regardless of whether they suffered actual damage, with separate compensation planned for more severely affected users. The firm also offered replacement computers.

The breach also compromised login credentials and account details for users of MetaTrader 4 and MetaTrader 5 trading platforms. Some customers reported seeing unrecognized transactions in their trading accounts, leading the company to urge users to reset their passwords and end all active sessions. Onamae continues to analyze the leaked data to determine the full scope of the affected customers and potential risks.

Summary

A major cyberattack on a cloud service provider forced the company to issue emergency shutdown instructions to protect customers from potential ransomware deployment. While the hackers leaked stolen data after a ransom demand was refused, the incident highlights the ongoing risks to user credentials and automated trading accounts.