Japan's GMO Internet has urged customers of its Onamae. com Desktop Cloud service to disconnect their computers from networks and switch them off following a cyberattack involving stolen information and threats of ransomware.The emergency instruction, issued ahead of a threatened attack on 27 October, asked users to run antivirus scans, back up their files, disconnect network connections and unplug cables. The company subsequently confirmed that suspected attackers had published material they claimed contained customer information, although it cautioned that the material was still being checked for accuracy.
GMO said on 28 October that the domain used to distribute the allegedly stolen information had been suspended following cooperation with other businesses. It warned that copies could appear elsewhere and asked customers not to visit, reproduce or circulate the material, citing the risk of further harm.
The company also launched a reward programme offering up to $1 million for information helping identify and apprehend those responsible. Its dedicated reporting service received 113 submissions during its first six hours on 28 October. GMO said it was examining the information rather than treating every submission as established evidence.
The security incident affects a cloud service that provides remotely accessible Windows desktop environments, including systems used to operate foreign exchange trading software. Customers can access these virtual machines over the internet, making the integrity of the hosted environment and stored credentials particularly important.
GMO acknowledged that its systems contained security vulnerabilities and that attackers had gained unauthorised access and removed customer information. It also received complaints about transactions that account holders did not recognise, raising concerns that credentials stored within the compromised service might have been misused.
Customers using MetaTrader 4 and MetaTrader 5 trading tools were instructed to change brokerage and trading account passwords from devices outside the affected cloud environment. GMO also advised them to end active sessions, examine account balances and transaction histories, contact their brokers about suspicious activity and enable two-factor authentication wherever available.
The company said the intruders demanded approximately eight billion yen in an extortion message received on 21 October. It rejected the demand, arguing that payment would provide no assurance that stolen information would be deleted or that further misuse would stop. Police and relevant authorities have been informed.
GMO began investigating after receiving customer inquiries on 19 October. It confirmed malicious software in some customers' server environments the following day and suspended new applications and access to the service control panel. On 21 October it began shutting down hosted servers across its plans to contain the intrusion.
The subsequent warning to disconnect personal computers reflected concerns about possible secondary infections beyond the company's hosted infrastructure. GMO collected devices voluntarily supplied by customers for forensic examination, with its security specialists analysing whether malware, including ransomware, had reached them.
By late morning on 27 October, the company said examinations completed at that point had found no malware on the devices checked. It stressed that testing was continuing and that the findings did not establish the safety of every customer's equipment. Later that day, it said no ransomware attack had been confirmed at the time of its afternoon update.
GMO has announced a standard payment of 5,000 yen for customers using the service, irrespective of whether they suffered a financial loss. It has also outlined arrangements concerning losses from unauthorised trading and alternative services, while considering additional payments for customers whose information was exposed.
The company has sought assistance from cybersecurity specialists, including Trend Micro, and called for stronger government measures against cyberattacks. It said its investigation would continue alongside cooperation with law enforcement and other organisations involved in limiting the distribution of stolen data.
GMO has also established dedicated channels for customers to report suspicious websites distributing information linked to the breach. It is working with relevant service providers to seek the removal of such material and has warned that deliberate redistribution could prompt legal action. The company has asked users to report newly discovered sites rather than share their addresses publicly, as wider circulation could expose affected customers to additional privacy violations and fraudulent approaches.
Customers have additionally been warned about messages impersonating GMO or offering to recover losses. The company said it would not request passwords or authentication codes and urged users to avoid responding to demands for payment connected with the incident.
Topics
Technology