Japan's GMO Internet Advises Customers to Shut Down PCs Amid Ransomware Threat
What Happened – On October 20 2026 GMO Internet’s Onamae Desktop Cloud (a popular Japanese VPS service) detected an intrusion that likely installed malware on up to 26,739 customer servers. The attackers exfiltrated company and customer data, published portions online, and demanded a ¥8 billion ransom. Although the ransomware payload was never activated, GMO warned that credentials for MetaTrader 4/5 trading platforms may have been compromised. To contain the risk, GMO shut down the affected servers, reduced service availability, and instructed customers to disconnect, power‑off, and unplug their PCs until the investigation (conducted with Trend Micro) was complete. Compensation of ¥5,000 per affected customer was announced, and legal action will be taken against anyone who further disseminates the leaked data.
Why It Matters for Trust & Control Assurance – The incident underscores the need for robust incident‑response controls and auditable evidence of containment actions.
Who Is Affected – Cloud‑infrastructure providers, VPS hosting services, and their enterprise customers (financial services, trading firms, SaaS platforms).
Recommended Actions –
- Review and test your incident‑response playbooks, ensuring documented shutdown and isolation procedures.
- Verify credential‑management controls (MFA, password rotation) and enforce immediate password resets for any exposed accounts.
Source: BleepingComputer
Technical Notes –
- Attack vector: malware deployment on VPS instances (likely via compromised admin credentials).
- Data exposed: company internal data, customer payment information (not exposed), and MetaTrader 4/5 trading‑account credentials.
- No ransomware execution observed on customer machines.
Source: BleepingComputer