GMO Cloud Breach Triggers Ransom Demand, Data Leak, Mass System Shutdown

Japanese domain registrar and VPS operator GMO Internet discovered a breach in its Onamae Desktop Cloud service on October 20 affecting as many as 26,739 customer servers. The attackers stole company and customer data, then demanded ¥8 billion ($50 million) in ransom while threatening to publish the information and deploy ransomware across affected machines. GMO refused the demand and instead warned customers to immediately disconnect from the internet and power down their systems, while coordinating recovery efforts with Trend Micro.

The threat escalated when attackers made good on leaking stolen data, prompting the company to urge a mass disconnect before a stated ransomware deployment deadline. Trading platform credentials and customer account details were exposed, though payment information remained secure. GMO confirmed the attackers held true to the data leak but ultimately did not activate any ransomware payloads. The company is offering ¥5,000 per affected customer plus potential additional compensation and replacement systems, while warning against further dissemination of the leaked data.