GMO Internet, one of Japan’s largest internet service providers and domain registrars, spent the final week of October fighting off an extortion attempt that threatened tens of thousands of customers, many of them day traders who rely on the company’s remote desktop service to run their trading software.
The trouble began on October 21, when GMO suspended its Onamae.com Desktop Cloud service after discovering that unauthorized programs had been installed on customer servers, according to BleepingComputer. Onamae.com Desktop Cloud is a virtual private server product that many retail traders in Japan use to run MetaTrader 4 and MetaTrader 5, the platforms widely used for foreign exchange and other markets. Up to 26,739 customer servers were potentially exposed, the company said.
On the same day it shut down the service, GMO received a ransom demand of roughly ¥7.9 billion, or about $50 million, payable in cryptocurrency by 5pm Japan time, according to figures reported by BigGo Finance. GMO contacted police the next day as its investigation expanded to include reports that customer trading accounts had been accessed without authorization.
Over the following days, the attackers cut their price sharply, to roughly ¥160 million, or about $1 million, and set a new deadline of noon Japan time on October 27. GMO refused to pay either amount. “The company has not complied with these demands and has made no payment whatsoever,” GMO Internet Group’s chairman and president, Masatoshi Kumagai, said, according to BigGo Finance’s translation of the company’s statement.
When the final deadline passed without payment, the attackers followed through on part of their threat. GMO confirmed that company and customer information had been published online and said it was working to verify how much of it was genuine. The company had also warned that a ransomware payload might be triggered on customer machines, and on October 27 it told customers to back up their files, disconnect from the network, shut down their computers, and unplug them before the deadline passed. By early afternoon that day, GMO said its scans of the customer devices it had checked so far had found no ransomware, though the investigation was continuing.
Exactly how many customers were affected, and what categories of personal data were exposed, has not been disclosed. GMO said payment card information does not appear to have been exposed, but some customers reported unauthorized trades on their accounts, suggesting that trading credentials or active sessions were compromised alongside other data. No hacking group has publicly claimed responsibility for the attack.
GMO said it would pay every affected customer ¥5,000, about $30, regardless of whether they suffered further harm, and that anyone whose computer was hit with ransomware would receive a replacement machine, with separate compensation for customers who lost money through unauthorized trading. The company also warned customers to be wary of unsolicited offers of paid data recovery help, said it would never ask for a password or authentication code, and said it would pursue legal action against anyone who shares the leaked data further.
Demanding payment while simultaneously threatening to leak stolen data and separately deploy ransomware has become a common tactic among extortion groups, who calculate that even a sharply discounted demand is worth collecting if a victim just wants the problem to go away. GMO’s decision to refuse payment at both the high and low figures, while absorbing the cost of compensating tens of thousands of customers directly, shows how expensive that stance can be even when a company sticks to it.
Source: BleepingComputer, “Japan’s GMO urges customers to shut down PCs amid ransomware threat,” October 27, 2026, with additional reporting from BigGo Finance.
