Japanese internet provider GMO Internet warned customers to disconnect their computers and back up their data after hackers threatened to launch a ransomware attack and publish stolen customer information on October 27, according to official company advisories: https://internet.gmo/en/news/article/255/ and https://internet.gmo/en/news/article/256/.
The warning follows a cyberattack on its Onamae.com Desktop Cloud service that exposed customer information and enabled unauthorized financial transactions.
GMO confirmed that attackers exploited vulnerabilities in its remote desktop service and accessed customers’ trading accounts. The company received a ransom demand of approximately $50 million and refused to pay. It has pledged to reimburse verified losses from unauthorized transactions and provide affected customers with compensation.
In a subsequent update, GMO confirmed that attackers published information purportedly belonging to the company and its customers. The company was still verifying the material and said it had not confirmed a ransomware attack as of 1:55 p.m. Japan time on October 27. Investigators continue examining customer devices for malware.
John Strand, Owner, Black Hills Information Security:
“The GMO attack looks like one of the worst-case scenarios for a company like GMO. Right now, though, all of us have very little technical information to actually go on. GMO has been good about notifying customers and telling people to shut things down, but the rest of the security community has basically been holding its breath waiting to find out what the initial attack vector actually was.
“Was this a vulnerability in GMO’s infrastructure? Was it credential harvesting that allowed the attackers to gain access? Was it something else entirely? We honestly do not know yet.
“But when you reach the point where you’re telling customers to back up their data and then shut their computers down, that is absolutely horrific. It becomes even more concerning when you consider how many people are using this service for financial trading applications. The potential impact goes far beyond simply compromising a server.
“In that regard, I give GMO definite credit for taking responsibility and telling customers, under no uncertain terms, to shut these systems down. At the same time, there is a huge responsibility to their customers and the broader security community in Japan to release the indicators of compromise associated with this attack as quickly as possible.
“There is also concern about whether this could be connected to the AI-assisted Artex activity that has been reported in Japan. We do not have enough evidence right now to say that it is. But if that connection is established, then it is time to start pulling fire alarms everywhere.
“This is one more incident making October absolutely miserable for information security professionals around the world. There simply aren’t enough technical details available yet to draw firm conclusions. We need to watch this very closely, get the indicators of compromise out to defenders, figure out exactly how the attackers initially got in, and see where the investigation takes us.”
ㅤ
Phillip Wylie, Chief Security Evangelist, Suzu Labs:
“What stands out about the GMO Internet incident is that attackers reportedly went beyond stealing customer information and gained access to trading accounts, enabling unauthorized financial transactions. This demonstrates how a vulnerability in a remote access service can have consequences far beyond the compromised system.
“Attackers don’t necessarily need to deploy ransomware to cause significant damage. If they can steal sensitive information, compromise accounts, and threaten to publicly release data, they already have multiple ways to pressure an organization.
“The reported $50 million ransom demand also highlights how extortion tactics continue to evolve. Organizations need to prepare for more than traditional ransomware attacks involving encrypted files. Data theft, financial fraud, and threats of public disclosure can be just as disruptive.
“From an offensive security perspective, this is why testing systems from an attacker’s point of view is so important. Organizations need to understand not only whether a vulnerability exists, but what an attacker could accomplish by exploiting it. Remote access services are particularly attractive targets because they can provide a pathway to sensitive systems and customer environments.
“Organizations should prioritize securing remote access infrastructure, implementing multifactor authentication, monitoring for suspicious account activity, and regularly conducting penetration tests that evaluate potential attack paths.
“The biggest takeaway is that preventing the initial compromise is important, but limiting what attackers can do once they gain access is equally critical.
“One important distinction: GMO’s October 27 update had not confirmed ransomware deployment as of 1:55 p.m. Japan time. The reported data publication and unauthorized transactions are serious developments, but they should not be presented as confirmation that ransomware was executed.”
I guess that “Black October” is the gift that keeps on giving. Which is very sad.
Related
This entry was posted on October 27, 2026 at 3:55 pm and is filed under Commentary with tags Japan. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
GMO Internet tells customers to disconnect their computers over ransomware attack concerns
Japanese internet provider GMO Internet warned customers to disconnect their computers and back up their data after hackers threatened to launch a ransomware attack and publish stolen customer information on October 27, according to official company advisories: https://internet.gmo/en/news/article/255/ and https://internet.gmo/en/news/article/256/.
The warning follows a cyberattack on its Onamae.com Desktop Cloud service that exposed customer information and enabled unauthorized financial transactions.
GMO confirmed that attackers exploited vulnerabilities in its remote desktop service and accessed customers’ trading accounts. The company received a ransom demand of approximately $50 million and refused to pay. It has pledged to reimburse verified losses from unauthorized transactions and provide affected customers with compensation.
In a subsequent update, GMO confirmed that attackers published information purportedly belonging to the company and its customers. The company was still verifying the material and said it had not confirmed a ransomware attack as of 1:55 p.m. Japan time on October 27. Investigators continue examining customer devices for malware.
John Strand, Owner, Black Hills Information Security:
“The GMO attack looks like one of the worst-case scenarios for a company like GMO. Right now, though, all of us have very little technical information to actually go on. GMO has been good about notifying customers and telling people to shut things down, but the rest of the security community has basically been holding its breath waiting to find out what the initial attack vector actually was.
“Was this a vulnerability in GMO’s infrastructure? Was it credential harvesting that allowed the attackers to gain access? Was it something else entirely? We honestly do not know yet.
“But when you reach the point where you’re telling customers to back up their data and then shut their computers down, that is absolutely horrific. It becomes even more concerning when you consider how many people are using this service for financial trading applications. The potential impact goes far beyond simply compromising a server.
“In that regard, I give GMO definite credit for taking responsibility and telling customers, under no uncertain terms, to shut these systems down. At the same time, there is a huge responsibility to their customers and the broader security community in Japan to release the indicators of compromise associated with this attack as quickly as possible.
“There is also concern about whether this could be connected to the AI-assisted Artex activity that has been reported in Japan. We do not have enough evidence right now to say that it is. But if that connection is established, then it is time to start pulling fire alarms everywhere.
“This is one more incident making October absolutely miserable for information security professionals around the world. There simply aren’t enough technical details available yet to draw firm conclusions. We need to watch this very closely, get the indicators of compromise out to defenders, figure out exactly how the attackers initially got in, and see where the investigation takes us.”
ㅤ
Phillip Wylie, Chief Security Evangelist, Suzu Labs:
“What stands out about the GMO Internet incident is that attackers reportedly went beyond stealing customer information and gained access to trading accounts, enabling unauthorized financial transactions. This demonstrates how a vulnerability in a remote access service can have consequences far beyond the compromised system.
“Attackers don’t necessarily need to deploy ransomware to cause significant damage. If they can steal sensitive information, compromise accounts, and threaten to publicly release data, they already have multiple ways to pressure an organization.
“The reported $50 million ransom demand also highlights how extortion tactics continue to evolve. Organizations need to prepare for more than traditional ransomware attacks involving encrypted files. Data theft, financial fraud, and threats of public disclosure can be just as disruptive.
“From an offensive security perspective, this is why testing systems from an attacker’s point of view is so important. Organizations need to understand not only whether a vulnerability exists, but what an attacker could accomplish by exploiting it. Remote access services are particularly attractive targets because they can provide a pathway to sensitive systems and customer environments.
“Organizations should prioritize securing remote access infrastructure, implementing multifactor authentication, monitoring for suspicious account activity, and regularly conducting penetration tests that evaluate potential attack paths.
“The biggest takeaway is that preventing the initial compromise is important, but limiting what attackers can do once they gain access is equally critical.
“One important distinction: GMO’s October 27 update had not confirmed ransomware deployment as of 1:55 p.m. Japan time. The reported data publication and unauthorized transactions are serious developments, but they should not be presented as confirmation that ransomware was executed.”
I guess that “Black October” is the gift that keeps on giving. Which is very sad.
Share this:
Like this:
Related
This entry was posted on October 27, 2026 at 3:55 pm and is filed under Commentary with tags Japan. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.