Japan’s GMO Internet has asked users of its Onamae.com Desktop Cloud service to shut down their computers, disconnect network cables, and pull power as a precaution, after hackers threatened to launch a ransomware attack. The warning followed confirmation of malicious code found in certain customer server environments and a demand for around ¥8 billion.
Incident Overview & Response
The company says attackers threatened to release customer data and trigger ransomware at noon Japan Standard Time on October 27, 2026. By 12:30 p.m., GMO reported that company and customer information had surfaced online. At 1:55 p.m., it clarified that while ransomware was not yet confirmed, investigations are underway. As of the latest reports, no malware has been found on customer devices where analysis was complete by 11:59 a.m., though that does not guarantee broader safety.
While malicious programs were confirmed in some hosted server environments on October 20, this threat has not been verified across all customer machines. GMO immediately began taking down affected servers—identified as 26,739 in total—across its Desktop Cloud plans starting at 4 a.m. on October 21. That number reflects potential exposure, not proven infections or data loss from personal computers.
Mitigation, Investigation & Customer Guidance
GMO has initiated a multi-part response. Customers have been urged to scan their systems, back up important data, shut down devices, and sever network connections. Contrastive to this, the company recommends avoiding reuse of credentials, being cautious with emails supposedly related to the incident, and confirming any notices through officially posted updates—highlighting that it will never ask for passwords or authentication codes in recovery efforts.
To support its investigation, GMO has gathered customer devices from around Japan and tasked its internal white-hat team with thorough inspections. External partners, including cybersecurity firm Trend Micro and unspecified AI companies, are also involved, though details of their engagement remain under coordination. For customers who experience verified ransomware damage, GMO has pledged a ¥5,000 compensation payment as well as replacement PCs comparable in performance. However, it has yet to identify a specific ransomware family, encryption system, or backup-destruction technique in its public statements.
Where Things Stand
The company received the ransom demand on October 21, then engaged law enforcement the following day. Although it declined to pay, GMO continues to rigorously trace the scope of the breach and examine whether personal devices were compromised. Despite certain server environments being impacted, there is no confirmation that user PCs are infected or that ransomware has definitively been deployed.
Recovery efforts are under way alongside risk mitigation—customers who suspect involvement are encouraged to follow orderly cleanup steps and rely only on official company updates. Incident reports emphasize that no credentialed device has shown malware where analysis has completed, but caution remains high given the evolving nature of the breach.
This episode joins a growing list of Japanese companies shutting down services to contain cybersecurity incidents—part of a broader trend where containment sometimes demands widespread disruption ahead of clarity.
Why it matters: Ransomware is now one of the most formidable threats in cybersecurity, and exposure in server environments used by many clients heightens the stakes. The GMO case is a stark reminder that even cloud‐hosted platforms need robust protection, fast incident response, and clear customer communication when threats arise.
