GMO Internet Group is analysing customer devices after an unauthorised access incident involving its Onamae.com Desktop Cloud service. The company is preparing for a threat to publish customer information and launch a ransomware attack.
In an alert published on October 26, GMO Internet Group and GMO Internet said the individuals believed to be behind the attack had threatened to disclose customer information and carry out a ransomware attack.
The investigation
The company has begun collecting devices from customers who agreed to cooperate. Its white-hat hacker team is examining them to determine whether attackers installed malware, including ransomware, and to establish the extent of the incident.
GMO said it would notify affected service users individually by email if the investigation identified additional security measures they needed to take.
No deal with attackers
GMO reiterated that it would not meet the attackers’ demands, because payment would not guarantee the deletion of stolen information or prevent its misuse. It said it had consulted the police and other relevant authorities and would keep coordinating its response with them.
Timeline
- October 21: GMO suspended the service and issued its first incident report. It also received a threatening email demanding approximately $51 million.
- October 22: GMO consulted the police.
- October 25: GMO asked customers to cooperate with device investigations.
- October 26: GMO began analysing collected devices and published the alert.
What GMO is telling customers
- Run full antivirus scans on their devices.
- Back up their data.
- Take steps to protect their accounts.
- Cooperate with the investigation so the security team can assess the incident and identify countermeasures.
- Ignore messages demanding payment in exchange for recovering losses.
GMO also warned that it would never ask customers to disclose passwords or authentication codes. It said it would publish further information on its website and contact customers directly if investigators identified new facts or additional protective measures.
Why it matters
The incident highlights the risks of unauthorised access to hosted desktop environments, where attackers may seek to compromise customer systems or obtain sensitive information. The threatened publication of customer data also raises concerns about potential exposure and misuse.
GMO said it would continue its investigation and response in coordination with relevant authorities. In the October 26 alert, the company had not established the full extent of the incident.
