GMO Internet is telling customers of its Onamae Desktop Cloud service to disconnect and shut down their PCs, after the attacker behind an October 20 breach threatened to trigger ransomware and leak stolen data. BleepingComputer reported the latest developments on October 27.
GMO detected the intrusion on October 20. It said malware could have been installed on up to 26,739 customer servers, and it shut servers down while it investigated. GMO says payment information was not exposed. MetaTrader 4 and 5 (MT4/MT5) credentials and trading-account details may have been exposed or compromised.
Per BleepingComputer, the attacker demanded ¥8 billion, about $50 million. GMO says it will not pay. It is offering each customer ¥5,000, about $30, in compensation. On October 26, GMO warned that the attacker planned to leak customer data and activate a ransomware payload planted on customer servers earlier in the attack. On October 27, the attacker published company and customer data. GMO is verifying it and may offer more compensation. BleepingComputer notes the ransomware threat does not appear to have been carried out, and no ransomware was reported active on customer machines.
Why it matters. This is a provider-side compromise. The attacker reached customer workloads through the hosting platform, not through each customer's own defences. The pre-positioned payload, held back as extortion leverage, is the pattern defenders should note. Customers running trading platforms face a second risk: stolen MT4/MT5 credentials can be used for unauthorised trades.
GMO's guidance. Back up data, then disconnect affected PCs from the internet, shut them down and unplug cables. MT4/MT5 users should reset passwords and terminate active sessions. GMO is working with Trend Micro on recovery and is scanning customer systems for remaining malware. It is offering replacement PCs to customers whose machines were damaged.
What to do if you rely on a hosted desktop or VPS provider. Treat any credential stored on the platform as exposed and rotate it. Revoke active sessions and API keys. Check broker and trading accounts for unauthorised activity. Keep offline backups that the hosting environment cannot reach. Review what your provider can push or execute on your instances, and monitor for it.
