GMO Warns Customers to Disconnect PCs After Cyberattack

Japanese technology group GMO Internet Group urged Onamae.com Desktop Cloud customers to scan their computers for malware, back up their data, disconnect from the internet and power down their PCs after a cyberattack and subsequent ransomware threats.

On October 20, 2026, GMO disclosed unauthorized access to Onamae.com Desktop Cloud and the installation of unauthorized programs in some customer server environments. The company said up to 26,739 servers were at risk and that it was shutting down affected servers, investigating the incident and cleaning them up.

The investigation found that attackers obtained sensitive customer data. GMO has not said how many customers were affected or specified all the information taken. Reports said the attackers demanded about $50 million and threatened to publish the data if the ransom was not paid. The data later leaked. GMO said it would not pay.

Attackers also threatened to install ransomware on customers’ devices, prompting a warning to disconnect and unplug PCs by 12:00 PM on Tuesday, October 27. No ransomware was found on customer servers, and the reported threat was not carried out.

GMO said it would compensate each customer $30, with separate compensation for customers who suffered greater damage. It also offered replacement computers, according to BleepingComputer. The company is analyzing the leaked data to assess the impact. It said login credentials and some account details for MetaTrader 4 and MetaTrader 5 users were compromised; some customers reported transactions they did not recognize. The full scope and material damage remain unknown.