GMO Rejects $50M Ransom, Advises Clients to Disconnect PCs

GMO Internet Group, one of the largest internet infrastructure groups in Japan, urged customers of the Onamae.com Desktop Cloud service to shut down their computers before noon on Tuesday, October 27, Tokyo time. "Before 12 PM on Tuesday, October 27, please back up, cut the internet, turn off the computer, and unplug it," the company stated in a release quoted by the Japan Times.

The warning followed an announcement made on the night of Monday, October 26. According to GMO, the attackers issued an ultimatum: either the company complies with their demands, or customer data will be published and ransomware activated by noon the next day. CEO Masatoshi Kumagai stated that the group received a ransom request of $50 million, refused it, and made no payment, according to TokyoReporter, BigGo Finance, and Cryptopolitan.

A Cloud Desktop Used for Operations

The Onamae.com Desktop Cloud is a virtual Windows server service, widely used by retail investors to keep trading platforms for currency and stocks online 24/7. GMO reported that an unauthorized third party gained access to their infrastructure and installed malicious software in the server environments of some clients.

An update on October 24 indicated that 26,739 servers were potentially affected, according to BleepingComputer and Gadget Review. The coverage itself notes that this figure measures exposure, not confirmed intrusions. Clients reported unauthorized trades in their trading accounts, and GMO committed to compensating losses from these trades, in addition to paying 5,000 yen to all current users of the service, according to Euronews and company statements.

GMO did not disclose how many customers had their data actually copied or what categories of information were at stake. As of the publication of this article, there was no public confirmation of what occurred after the noon deadline, which corresponded to 3 AM UTC on Tuesday. No criminal group had publicly claimed responsibility for the attack in the consulted sources.

Why the Request to Disconnect PCs Matters

The most unusual detail of the case is the extent of the risk. A trading virtual server typically remains connected to the client's computer via remote desktop. If the attacker controls the server, the channel that the user opens to operate could become a bridge to the local machine. This is why GMO requested a physical disconnection, rather than just a password change.

The refusal to pay aligns with the Counter Ransomware Initiative, a coalition of dozens of governments led by the United States, which since 2023, has recommended against funding digital extortion. The cost of this position appears elsewhere: the compensation for trading losses comes from GMO's funds, and the company has yet to estimate the value.

The Same Risk in Other Markets

In Japan, the Personal Information Protection Law requires companies to notify the Personal Information Protection Commission and affected individuals when there has been a leak that may cause harm, with a preliminary report in a few days. For brokers whose clients placed unauthorized trades, the case also opens a discussion about what to do when legitimate client access originates from a compromised machine.

In the European Union, the NIS2 directive already classifies managed service providers and cloud services as entities subject to preliminary notification to the regulator within 24 hours of becoming aware of a significant incident. A case like GMO's, with access to the provider's infrastructure and cascading effects on clients, is precisely the scenario that motivated the rule.

In Brazil, the ANPD's 2024 incident communication regulation sets a deadline of three business days to notify the authority and affected individuals, and the Central Bank's rules for regulated institutions require communication of significant incidents, including those involving contracted cloud services. Virtual server services for trading bots are also sold to retail investors in these markets, almost always outside the inventory of third parties controlled by a broker's CISO.

For a CISO of a financial institution, the practical lesson is not about GMO. It's about the client operating from an infrastructure that the broker did not contract, does not audit, and only discovers when unauthorized orders appear in the book.