GMO Tells Customers to Power Down PCs After Cloud Attack

Japanese technology company GMO Group has made an unusual request of its customers following a cyberattack and subsequent threats from the attackers. The company asked users to scan their computers for viruses, back up all their data, disconnect the devices from the internet and then shut them down. The announcement explicitly told customers to unplug every cable connected to the computer.

According to reports, the attackers stole customer data, leaked information and threatened to spread ransomware. The theft of credentials for trading platforms, and reports from some users of transactions they did not recognize, have heightened concern about the impact of the incident.

The target: Onamae Desktop Cloud

GMO Internet Group is a large Japanese technology conglomerate active in internet infrastructure, cybersecurity, online advertising and financial services. It earns billions of dollars in annual revenue and has numerous subsidiaries, one of which runs Onamae Desktop Cloud, a popular VPS service. The service gives users a rented Windows desktop hosted on GMO's servers, so customers can keep their trading applications running even when their own computers are switched off. The customer base appears to consist largely of Japanese retail forex (FX) traders who rely on automated trading software.

In a statement on October 20, 2026, the company said the attackers had installed malware in some customer environments. Reportedly 26,739 servers were at risk; the company shut them down in stages, launched an investigation and carried out cleanup work. At the time, it confirmed that a third party had gained unauthorized access to Onamae.com Desktop Cloud and that unauthorized programs had been installed on some customers' server environments.

Ransom demand and data leak

The investigation concluded that the attackers had also obtained sensitive customer data. However, the company has not disclosed how many customers were affected or what types of information were stolen. Later reports said the unidentified attackers demanded roughly $50 million to delete the data and threatened to publish it on the dark web if payment was not made.

Onamae announced that it would not pay the ransom, and the data was ultimately leaked. Even so, no known party has claimed responsibility for the attack. The company also warned the public and the media not to share the leaked information, saying it would take legal action against anyone who did.

The call to customers and compensation

The attackers also threatened to install ransomware on Onamae customers' devices. In response, the company issued a three-step appeal: run a full scan of the device, make a backup, and cut the computer off from both the network and power. The notice asks customers to back up their data, disconnect from the network, shut down the device and unplug connected cables before noon on Tuesday, October 27. The ransomware threat does not appear to have been carried out; no such software was found on customer servers.

Rather than pay the ransom, the company said it would pay every customer $30 in compensation, regardless of whether they suffered harm, with additional compensation for those more seriously affected. Replacement computers were also offered. One of the company's updates noted that login details and some account information for customers using the MetaTrader 4 and MetaTrader 5 trading platforms had been compromised, and some customers reported seeing transactions in their trading accounts that they did not recognize. The company urged users to reset their passwords and terminate all active sessions.

The investigation is ongoing, and the company is analyzing the leaked data to determine how many customers were affected and what is at risk. The full scope of the attack and the extent of the financial damage remain unclear, though the losses are expected to be significant.