Japanese internet giant GMO tells customers to unplug PCs after compromise

Japanese technology conglomerate GMO Group warned customers of its Onamae.com Desktop Cloud service to scan their computers for malware, back up files, disconnect from the internet, and power down after a cyberattack and ransomware threat. The service provides hosted Windows desktops used by retail forex traders to keep automated trading software running. GMO disclosed on October 20 that attackers had accessed customer environments and installed unauthorized programs; as many as 26,739 servers may have been at risk. The company shut down affected systems and began investigating and removing the malware.

The attackers reportedly stole customer data, demanded about $50 million to delete it, and threatened to publish it if GMO refused. The company declined to pay, and the data was subsequently leaked. Attackers also threatened to deploy ransomware on customers’ own devices, prompting the shutdown warning, but no ransomware was found on customer servers. GMO is examining the leaked material to establish the number of affected users and potential harm, and says some MetaTrader 4 and 5 login credentials and account details were compromised. Some customers reported transactions they did not recognize, so GMO urged them to change passwords and end active sessions. It offered customers $30 each, with additional compensation for significant losses, and replacement computers in some cases.