Japan’s GMO Internet Urges Customers to Shut Down PCs After Hackers Threaten Ransomware Attack

Japan’s GMO Internet urged customers of its Onamae.com Desktop Cloud service to disconnect their PCs, shut them down, and unplug connected cables after suspected attackers threatened a ransomware attack.

The warning followed a breach involving malicious programs on customer servers and an extortion demand of approximately ¥8 billion.

The attackers threatened to publish customer information and launch ransomware at noon Japan Standard Time on October 27, 2026.

GMO later confirmed that alleged company and customer information appeared online at 12:30 p.m. However, its update at 1:55 p.m. said no ransomware attack had been confirmed, and the published material was still being checked.

GMO Internet Group researchers noted that they were examining customer devices for malware, including ransomware.

Importantly, the company’s ninth incident response report said no malware had been found on devices whose analysis was complete by 11:59 a.m. That finding did not establish that every customer’s computer was safe.

Japan’s GMO Internet Urges Customers

GMO’s shutdown request was a precaution against a threatened attack, not confirmation that ransomware had spread across customers’ personal computers.

The distinction matters: malicious programs had been confirmed in some hosted server environments, while investigators were separately checking customer devices.

The company asked users to scan their systems, back up data, disconnect network connections, and switch off their PCs. The disruption follows other Japanese incidents where companies stopped services to limit damage.

During the Niconico cyberattack service suspension, operator Dwango also took its platform offline while investigating. Such shutdowns interrupt normal activity, but GMO’s warning focused on reducing customers’ exposure while the scope of the compromise remained uncertain.

According to GMO’s initial unauthorized access notice, the company confirmed malicious programs in some customer server environments on October 20.

It identified 26,739 servers as potentially affected and began shutting down servers across all Desktop Cloud plans from 4 a.m. on October 21. Information stored inside those environments could have been viewed.

That server count should not be read as a confirmed number of infected personal computers or customers whose data was stolen.

GMO’s first notice described potential server exposure, while later updates addressed device investigations and alleged leaked information. The company has not publicly connected those categories through a verified, final victim count in the notices reviewed.

GMO received the threatening email demanding approximately ¥8 billion on October 21 and consulted police the following day.

It refused payment, explaining that meeting the attackers’ demands would not guarantee deletion of stolen information or prevent misuse. The company continued coordinating with investigators and relevant authorities as its response expanded.

Device Investigation, Account Protection, and Recovery

GMO employees collected customer devices across Japan after requesting cooperation on October 25. Its white-hat hacker team began examining the submitted systems, with more devices expected.

Trend Micro and AI companies offered assistance, although GMO described the details of their involvement as still being coordinated rather than announcing a completed joint investigation.

Backups formed another part of GMO’s customer guidance. Separate reporting on ransomware operators disabling backups explains why recovery systems deserve protection alongside endpoints.

That broader behavior has not been attributed to the GMO attackers; the company’s public notices did not identify a ransomware family, a backup-destruction technique, or an encryption mechanism.

Customers were also told to change credentials stored or used on affected servers, including passwords reused elsewhere. GMO warned that it would never request passwords or authentication codes and urged users to distrust messages offering paid recovery.

Its tenth report advised checking official notices instead of opening links or files in incident-related emails or text messages.

Recovery commitments included a previously announced ¥5,000 payment and replacement PCs of equivalent performance for customers whose ransomware damage was verified.

These measures do not prove ransomware occurred. Meanwhile, Google’s air-gapped backup vaults illustrate how separating protected recovery copies from ordinary workloads can support resilience, although GMO did not announce use of that technology.

Indicators of compromise (IoCs):-

Indicator category	Source disclosure
SHA-256, SHA-1, MD5 hashes	Not published
Malicious IP addresses or domains	Not published
Malware filenames or paths	Not published
Ransomware family or encryption extension	Not identified
Exploited vulnerability or CVE	Not disclosed

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.