GMO Group Advises Customers to Disconnect Systems Amid Ransomware Threat

The GMO Group has urged customers to disconnect their systems from the internet and shut down computers following a breach of the company’s Onamae Desktop Cloud, where a threat actor threatened to launch a ransomware attack.

Data belonging to both the company and its customers has reportedly been published online.

This alert is linked to a cyberattack on Onamae Desktop Cloud, a popular VPS provider in Japan operated by GMO Internet, a major domain registrar in the country.

On October 20, the company announced it detected an intrusion that could have installed malware on up to 26,739 customers’ servers. To mitigate the risk, GMO shut down the servers and reduced service availability while launching an investigation.

The company assured customers that their payment information had not been exposed, but warned that credentials for MetaTrader 4 and MetaTrader 5 (MT4/MT5) and trading-account details may have been compromised. Customers were advised to reset their passwords and terminate active sessions.

Details of the Cyberattack

Subsequent updates confirmed that data had been stolen, and the attacker was demanding a ransom of ¥8 billion ($50 million), which GMO stated it would not pay. Instead, the company announced it would compensate each affected customer ¥5,000 ($30) for the inconvenience.

On October 26, GMO warned that the attackers planned to leak customer information online and activate a ransomware payload that had been planted on customer servers earlier in the attack.

The following day, the company advised customers to disconnect their PCs from the internet, shut them down, and unplug all cables before noon, while it collaborated with Trend Micro to recover from the cyberattack.

“Once you have a backup, disconnect the network, power it down, and unplug the cord that connects to your PC,” the company advised customers.

Customer Support and Compensation

GMO stated it was scanning customer systems to check for remaining malware and offered equivalent PC replacements to those who suffered damages from the ransomware attack.

In a report published earlier, the company confirmed that the threat actor had published company and customer data, prompting efforts to verify the authenticity of the leaked information.

For customers whose information was exposed, GMO indicated it would consider additional financial compensation.

It appears that the attacker did not act on their threat, as no ransomware was activated on customer machines.

GMO also warned the public and media against disseminating the exposed information, announcing plans to take legal action against those who do, while reaffirming its refusal to pay the attackers.

Source: BleepingComputer