Japanese internet group GMO Internet refused a roughly $50 million ransom after the GMO cloud desktop breach of Onamae.com Desktop Cloud. On 27 October, attackers claimed to publish customer and company data once a noon deadline passed, after the trader virtual-desktop service was shut down on 21 October. India Today reported 26,739 servers could be affected, and the incident pairs a claimed data leak with unauthorized trades.
Key Takeaways
- GMO refused a roughly 8 billion yen ransom after the Onamae cloud breach.
- Attackers claimed to publish customer data after a noon 27 October deadline.
- India Today reported 26,739 servers could be affected, plus unauthorized trades.
- Katayama said five FX firms using the service, such as OANDA, were affected.
How the GMO Cloud Desktop Breach Unfolded
According to The Mainichi, a customer inquiry led investigators to confirm on 20 October that a third party had installed an unauthorized program in some customers’ server environments. TechCrunch reported that GMO shut the service on 21 October and received an email demanding about 8 billion yen, roughly $50 million. It reported the incident to Japanese police on 22 October.
On 24 October GMO said it would offer compensation and an alternative service while seeking government help, TechCrunch reported. The Straits Times reported that GMO asked the government to deploy active cyberdefence, and that shares fell the most since 2011 on 26 October. On 25 and 26 October the company began collecting customer devices to detect malware.
The Straits Times, in a Bloomberg-credited report, said a GMO spokesperson said trading had been suspended since 21 October, new subscriptions were paused, and every Onamae.com user could be affected after all the cloud service’s servers were compromised. TechCrunch said 27,000 servers may be affected. India Today cited 26,739.
Why GMO Refused the Ransom
India Today quoted the company: “We will not comply with the attackers’ demands. This is because complying with their demands does not guarantee that the information they obtained will be deleted or that its unauthorised use will be prevented.”
The Mainichi reported CEO Masatoshi Kumagai said the demand was $50 million in cryptocurrency, which the firm will not pay. The Japan Times, in a Bloomberg-credited report, put the demand at about $1 million. That conflicts with the roughly $50 million figure reported by TechCrunch, The Straits Times, India Today and The Mainichi.
The Japan Times reported that the hacker group said in an online post: “We have been setting the deadline at 12 p.m. (noon) but GMO is not engaging in any negotiations.” It continued: “Therefore, we will disclose the personal information.”
After noon, GMO said posted material appeared linked to the company and its customers and was still being checked, TechCrunch reported. Asked about the alleged disclosure, it told The Mainichi it “refrains from commenting on every event.” The Straits Times said that almost two hours after noon GMO had not confirmed a follow-up ransomware attack, which the hackers had also threatened.
The Mainichi said GMO will offer up to $1 million under its GMO Cybercrime Bounty program for information identifying the hackers, and up to 3 million yen ($19,000) where personal-information exposure is confirmed.
Unauthorized Trades and Customer Payouts
India Today reported unauthorized trades through accounts linked to more than 70 securities firms, foreign-exchange providers and other businesses. Separately, it said Japan’s finance minister said five foreign-exchange margin-trading services connected to GMO had been affected, with some customers reporting financial losses.
The Mainichi reported Finance Minister Satsuki Katayama noted that five foreign-exchange trading firms using the GMO server service, such as OANDA Japan, had been affected. The companies, including Goldenway Japan and Ava Trade Japan, have reported to the Financial Services Agency that customers had been affected by the attack.
She said, “We cannot rule out the possibility of further unauthorized transactions, so we will respond with a sense of urgency,” The Mainichi reported.
GMO promised compensation for losses from unauthorized transactions and a 5,000 yen goodwill payment to all customers, India Today reported. TechCrunch said customers were told to reset passwords after “unauthorized operations” on trading accounts.
| Item | Figure reported | Source |
|---|---|---|
| Ransom demand | About 8 billion yen (~$50 million) | TechCrunch; India Today |
| Servers potentially affected | 26,739 / 27,000 | India Today; TechCrunch |
| Firms tied to unauthorized trades | More than 70 | India Today |
| FX firms Katayama said were affected | Five, such as OANDA Japan | The Mainichi |
| Goodwill payment | 5,000 yen per customer | India Today |
| Confirmed exposure payment | Up to 3 million yen ($19,000) | The Mainichi |
| Identification bounty | Up to $1 million | The Mainichi |
What Customers Were Told to Do
Paying would not guarantee deletion or block later misuse, GMO said, while a claimed leak and unauthorized trades can still generate loss. A follow-up ransomware attack, which the hackers had also threatened, was still unconfirmed almost two hours after noon, The Straits Times reported.
- Back up data, scan for viruses, disconnect and unplug devices, as GMO urged.
- Reset passwords after reported unauthorized operations on trading accounts.
- Do not access or share posted files while GMO’s verification continues.
- Some clients had flagged transactions they had not initiated, The Straits Times reported.
TechCrunch reported GMO’s cybersecurity unit recently reported finding evidence that the Chinese AI tool Artex had been used in hacks targeting companies in Japan. The company has not publicly established a connection between Artex and the Onamae breach. An FSA spokesperson told TechCrunch that May guidance urged “vulnerability management, defense-in-depth and incident preparedness.”
Katayama said there was “a sense of crisis shared globally,” The Straits Times reported. Prime Minister Sanae Takaichi instructed her Cabinet on 26 October to draw up emergency measures by the end of next week, the same report said. In a blog post, CEO Masatoshi Kumagai wrote, “The internet itself is now starting to break down,” India Today reported.
