GMO Internet told customers of its Onamae.com Desktop Cloud service on October 27, 2026 to power down their PCs before a ransomware deadline, after suspected attackers said they would publish customer information and launch an attack at 12:00 that day. Jiji Press coverage carried by Nippon.com described the notice as a warning of an imminent cyberattack. Outlets including Investing.com, Rescana and The Cyber Express reported that the extortion demand stands at US$50 million.GMO Internet ransomware warning: what happened on October 27The Onamae.com Desktop Cloud service at the centerWhat GMO told customers to do before the deadlineThe US$50 million demand and GMO’s refusalHow the earlier intrusion set the stageWhat is confirmed and what is notGMO’s 13:55 update: no ransomware attack confirmedWhy unplugging a PC works as a ransomware defenseWhat power-down does and does not stopA minimal Windows scan routineJapan’s ransomware backdrop and recent local incidentsMarket impact: cloud desktops, forex traders and trustCompetitive comparison: how other victims handled public deadlinesHistorical context: the pay-or-refuse debateFive predictions for the GMO case and hosted-desktop securityWhat customers and IT teams should do nowFrequently asked questionsWhat did GMO Internet announce on October 27, 2026?How much are the attackers demanding?Will GMO pay the ransom?Did the ransomware attack actually happen?Was customer data stolen?Who is behind the attack?What should I do if I use Onamae.com Desktop Cloud?Related Coverage
The story matters beyond one Japanese cloud service. A major internet group has told paying users, in plain language, to unplug their machines from the wall. That is rare, and it lands in a year when Japan’s ransomware caseload hit a record high in the first half. This analysis walks through what GMO has confirmed, what remains unproven, and what the episode signals for cloud desktop providers and their customers.
Industry insights, the latest tech news, and special interviews, all in the Tech Insider Newsletter.
One email a week. No spam, unsubscribe anytime.
One caution up front. Several figures circulating online, including a reduced US$1 million demand and a count of 26,739 affected servers, did not appear in the official GMO notice or the principal reports. This article treats them as unconfirmed and leaves them out of the analysis.
Google · Preferred Sources
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
GMO Internet ransomware warning: what happened on October 27
GMO Internet, Inc., identified in some coverage as GMO Internet Group Inc., published an emergency notice on its service pages. The company said persons believed to be the attackers had told it they would release customer information and carry out a ransomware attack at 12:00 on Tuesday, October 27, 2026. In a statement quoted in coverage, GMO said: “We have received a notice from the suspected attacker that they will release customer information and launch a ransomware attack at 12:00 PM on Tuesday, October 27th.”
The wording matters. GMO called the senders suspected attackers and described the threat as a notice it had received. It did not claim to have confirmed who they are, and no outlet in the verified set names a group. The Japan Times framed the story with a headline that says GMO told account holders to prepare for the worst as hackers threaten exposure, which matches the tone of the notice itself.
You may like
Yahoo Finance’s Australian edition ran the story under the headline “Japan’s GMO Internet warns users of impending ransomware attack,” and ABAB News reported that GMO urged customers to disconnect and shut down their PCs before 12:00 on October 27. Taken together, the outlets agree on the core facts: a named service, a named deadline, a dollar demand, and a refusal to pay.
The Onamae.com Desktop Cloud service at the center
The affected service is Onamae.com Desktop Cloud. It is a hosted desktop product, which means customers connect to a remote Windows environment run by GMO rather than working only on a local machine. According to GMO’s earlier disclosures, the intrusion touched servers used for automated foreign-exchange margin-trading services, and user personal information may have been compromised.
That detail shapes the risk profile. Automated trading setups often run around the clock on remote desktops, and the people who rent them tend to keep brokerage logins, strategy files and scripts on the same machine. A breach of that environment reaches into money-handling workflows, not just email lists.
The official investigation finding, as reported, is blunt. The service had security vulnerabilities, its environment was accessed without authorization, and customer information was taken outside the company. GMO has not, in the sources reviewed, published the exact volume or category of data removed, and this article does not guess at either.
What GMO told customers to do before the deadline
GMO’s guidance was specific and sequential. Customers were told to run a full antivirus scan, back up their data, disconnect the PC from the network, shut it down, and unplug connected cables before the stated deadline. In its eighth report on the incident, GMO wrote: “Before 12:00 on Tuesday, October 27, please back up your data, disconnect from the network, shut down the power, and unplug the cords connected to your PC.”
A later notice, which GMO labeled its ninth public update, repeated the threat in softer language. It said the attacker is believed to have announced that it would publicly disclose customer information and carry out a ransomware attack at 12:00 on Tuesday, October 27. The same update asked customers to perform a full virus scan on their own devices.
The order of the steps carries logic. Scanning first catches an implant that might already sit on the endpoint. Backing up second preserves data, though a backup copied from an infected machine can itself carry the infection, so customers should store it offline and scan it before restoring. Disconnecting and powering down last cuts any remote channel the attacker might use to trigger encryption. For readers building their own playbooks, our guide on how to protect against ransomware in 13 steps covers the same ground in more depth.
The US$50 million demand and GMO’s refusal
Outlets including Investing.com and Rescana put the extortion demand at US$50 million. GMO said it would not accept or comply with the demand. TokyoReporter’s headline captures the stance: GMO refuses the demands even as hackers threaten a data leak and a ransomware attack at noon Tuesday.
A refusal at this scale is a strategic choice. Paying a seven-figure or eight-figure sum to a group that has already stolen data buys, at best, a promise of deletion that nobody can audit. It also marks the payer as willing, which invites repeat attempts from the same crew and copycats. GMO’s public position gives regulators and customers a clear line: no money moves, and the company will absorb the consequences openly.
News Minimalist, an aggregator, summarized one thread under the headline GMO pledges full compensation after cyberattack as ransom deadline looms. The headline is the only part of that claim this article relies on, and the terms of any compensation, including who qualifies and how losses get calculated, remain unspecified in the verified material.
How the earlier intrusion set the stage
The October 27 deadline did not appear from nowhere. GMO’s eighth and ninth reports show a company that has been issuing serial updates on unauthorized access to Onamae.com Desktop Cloud. The ransom notice is the latest escalation in a sequence that started with the discovery of the intrusion and moved through investigation, service restrictions and customer outreach.
Extortion on a countdown is a recognizable pattern. Attackers who have already exfiltrated data move to a second phase, where the threat is publication or encryption on a date they control. The deadline serves two purposes. It pressures the victim’s executives, and it pressures the victim’s customers, who then call support lines and complain, which adds to the cost of holding out.
GMO has tried to flip that pressure. By publishing the deadline, the instructions and the refusal in the same breath, it moved the conversation from whether it would pay to how ready its customers were. Whether that works depends on how many users actually act on the instructions, a number GMO has not disclosed.
What is confirmed and what is not
Fast-moving incidents attract rumor. The table below separates items that the fact sheet and the verified reports support from items that remain open as of publication.
ItemStatusBasisThreat to publish customer data and launch ransomware at 12:00 on October 27Confirmed as a threat receivedGMO statement, Jiji Press, Japan TimesAffected service is Onamae.com Desktop CloudConfirmedGMO noticesUS$50 million demandReported by multiple outletsInvesting.com, Rescana, The Cyber ExpressGMO will not comply with the demandConfirmedGMO statement as reportedUnauthorized access and data taken outside the companyOfficially reported findingGMO investigation findingsIdentity of the attackersUnconfirmedNo outlet names a groupExact amount and type of data takenUnconfirmedNot published in the notices reviewedReduced US$1 million demandUnconfirmedNot in the official notice26,739 affected serversUnconfirmedNot in the official noticeCustomer data publicly releasedUnconfirmedNo verified report
Readers who see the unconfirmed numbers repeated on social media should treat them as rumor until GMO or a named outlet with direct sourcing backs them.
GMO’s 13:55 update: no ransomware attack confirmed
The deadline came and went, and GMO posted a status check afterward. On its Onamae.com news page, the company wrote: “As of 13:55 on October 27, no ransomware attack has been confirmed.” That is a narrow statement. It says GMO had not confirmed an attack at that moment, and it does not say the threat was empty or that the danger has passed.
You may like
There are at least three readings. The attackers may have bluffed about their ability to deploy ransomware, and the data theft could be the real asset they hold. Customers who followed the shutdown instructions may have blunted an attack that was otherwise ready. Or the intruders may be waiting, since a threat tied to a clock does not have to resolve on that clock.
GMO also warned customers about material that attackers might publish. In another notice it asked people not to access or disseminate information purported to have been disclosed. That instruction guards against two harms. Downloading leaked files can expose a reader’s own machine to malware, and spreading personal data widens the damage to the people named in it.
Why unplugging a PC works as a ransomware defense
Telling users to pull the plug sounds crude, yet it follows sound incident-response logic. Ransomware needs a running machine and, usually, a network path to spread. A powered-off device with its cables removed cannot encrypt files, cannot receive commands and cannot move laterally to a neighbor.
What power-down does and does not stop
Shutdown halts encryption and command traffic for as long as the machine stays off. It does not remove a persistence mechanism that restarts when the system boots, and it does not undo data theft that already happened. Customers who power back on should do so from a clean, isolated network segment and scan before reconnecting. Teams that want earlier warning can follow our walkthrough for Sysmon setup to detect ransomware.
A minimal Windows scan routine
For a Windows endpoint, the built-in Microsoft Defender tooling can run a full scan from an elevated PowerShell prompt before the machine goes offline. Third-party antivirus products have their own equivalents.
Update-MpSignature
Start-MpScan -ScanType FullScan
Get-MpThreatDetection | Format-Table InitialDetectionTime, ThreatID, Resources
The first line refreshes signatures, the second runs the scan, and the third lists anything it flagged. These commands support GMO’s request for a full virus scan and do not replace professional forensics for a machine that holds sensitive trading credentials.
Japan’s ransomware backdrop and recent local incidents
GMO’s episode sits inside a busy period for Japanese targets. Our earlier reporting counted 123 ransomware cases in Japan in the first half of 2026, a record. The country’s cloud and telecom sector has taken several hits this year, and the table summarizes headline figures from our own coverage.
IncidentHeadline figureTypeJapan ransomware, first half of 2026123 cases, record highSector-wide countIDCF Cloud495 clients downCloud ransomwareKDDI12.2M users across 6 ISPsData breachAflac Japan4.38M hit in a second attackData breachGMO Onamae.com Desktop CloudUS$50M demand reportedExtortion threat
The closest parallel is the IDCF Cloud ransomware attack that took 495 clients offline. Both cases hit hosted infrastructure, where one compromised provider multiplies the harm across many tenants. The difference is timing. IDCF customers learned of the problem after the damage, while GMO’s customers got a warning with a clock on it.
Market impact: cloud desktops, forex traders and trust
No verified source in this research reports a stock move for GMO shares tied to the warning, so this article offers none. The commercial exposure shows up elsewhere. Hosted-desktop vendors sell convenience and uptime, and a ransomware countdown undercuts both. Prospective customers will ask harder questions about isolation between tenants, credential storage and incident communication.
Read nextRansomware Recovery Scam Nets $11M as AI Hits Banks [2026]Cybersecurity · Oct 9
Forex automation users face the sharpest dilemma. Shutting down an automated trading desktop can leave open positions unmanaged, which is a financial risk of its own. Anyone who runs strategies on a hosted machine should know in advance how to flatten or hedge positions from another device, and should keep broker credentials separate from the hosted environment. Downtime has a price even when no ransom is paid, a point we quantified in our look at the true cost of ransomware downtime.
For enterprise buyers, the incident adds a due-diligence item. Procurement teams should request a provider’s last penetration test summary, its notification timeline commitments and its customer-isolation architecture. GMO’s practice of publishing numbered reports, with the ninth already out, sets a benchmark for cadence even as the breach itself sets a benchmark for concern.
Competitive comparison: how other victims handled public deadlines
GMO is not the first company to face a public ransom clock. Comparing outcomes and stances across recent cases on this site shows a spread of approaches, from silent handling to loud refusal.
CaseDemand or scaleStance reportedGMO Onamae.com Desktop CloudUS$50M reportedRefuses, publishes deadline and user instructionsMcKesson$55M demand, 284M records claimedConfirmed breach in an SEC filingBerlin government (Rhysida)30 BTC, 6TB leakedRefused, data leakedManchester Airports GroupData from 3 airports leakedRejected the ransomUHSP (LockBit)$1.25M demandPaid $0
The Berlin case is the cautionary one. After the government refused a 30 BTC demand, the attackers leaked the data, and we documented how a seven-day isolation gap let Rhysida steal data. GMO’s advantage, if it holds, is that it told customers to isolate their machines before the deadline rather than after. Refusing to pay does not prevent a leak, but fast containment can limit what an attacker can encrypt.
Historical context: the pay-or-refuse debate
Ransomware crews moved from pure encryption to double extortion several years ago, stealing data first and threatening publication second. The model makes backups less decisive. A company can restore from a clean backup in hours and still face the leak of customer records, which is the exact threat GMO describes.
Government and industry guidance in many countries has long discouraged payment, and attitudes have hardened as payouts fund the next wave of attacks. GMO’s refusal fits that trend. It also fits a Japanese corporate culture of public apology and detailed disclosure after incidents, visible in the serial numbered reports the company has issued.
What is newer is the use of customer shutdown as a primary defense. Most providers contain incidents on their own side of the wall. Asking thousands of end users to cut power in unison is a statement that the provider cannot guarantee the safety of connected endpoints, and that admission is part of why this story drew attention from outlets in several countries.
Five predictions for the GMO case and hosted-desktop security
These are analyst judgments, not reported facts. Each could prove wrong as GMO’s investigation continues.
More numbered reports from GMO. The company has already reached at least a ninth public update, and the threat is still unresolved. Expect further bulletins on the forensic findings and service status.A data leak attempt remains likely. The 13:55 update only says no ransomware attack was confirmed at that time. Extortionists who hold stolen data often publish samples to restore pressure, so GMO’s warning against accessing purported leaks may become relevant.Regulatory scrutiny in Japan. A breach of personal information at a major hosting group tends to draw questions from authorities, and the financial angle of forex automation raises the chance of attention beyond the data-protection side.Competitors will advertise isolation. Rival virtual-desktop vendors will publish security whitepapers and tenant-isolation claims within weeks. Buyers should demand evidence rather than marketing copy.Kill-switch playbooks go mainstream. Providers will draft customer-facing shutdown procedures as a standard annex to incident plans. Our cybersecurity coverage will track whether that becomes a norm.
What customers and IT teams should do now
Anyone with an Onamae.com Desktop Cloud account should follow GMO’s official notices first and treat third-party summaries, including this one, as secondary. Beyond that, a short list of precautions applies to any user of a service that has reported unauthorized access.
Change passwords for any account whose credentials were stored on or typed into the affected environment, starting with brokerage and email logins.Enable multi-factor authentication on every financial account, preferring app-based or hardware methods over SMS.Review recent trading and login activity for anything unfamiliar and report it to the broker immediately.Keep an offline copy of critical files and verify that it restores correctly.Watch for phishing that cites the breach, since scammers often exploit news of an incident to pose as the provider.Avoid opening or sharing files that claim to be leaked GMO data.
The last item matches GMO’s own request. Leak archives are a common malware delivery route, and the people most eager to look at them are often the ones with the most to lose.
Frequently asked questions
What did GMO Internet announce on October 27, 2026?
GMO said suspected attackers had notified it that they would release customer information and launch a ransomware attack at 12:00 on Tuesday, October 27. It told Onamae.com Desktop Cloud users to scan for viruses, back up data, disconnect from the network, shut down and unplug cables.
How much are the attackers demanding?
Outlets including Investing.com, Rescana and The Cyber Express reported a demand of US$50 million. Claims of a reduced US$1 million demand are unconfirmed.
Will GMO pay the ransom?
No. GMO said it would not accept or comply with the demand, a position reported across several outlets.
Did the ransomware attack actually happen?
Not as of GMO’s latest status line. The company wrote that as of 13:55 on October 27, no ransomware attack had been confirmed. That statement covers a single point in time, so customers should keep checking official updates.
Was customer data stolen?
The officially reported finding is that the service had security vulnerabilities, was accessed without authorization, and that customer information was taken outside the company. The exact amount and type of data has not been confirmed in the notices reviewed.
Who is behind the attack?
Unknown. GMO refers to suspected attackers, and none of the verified reports names a group.
What should I do if I use Onamae.com Desktop Cloud?
Follow GMO’s official instructions, run a full scan, keep an offline backup, change credentials stored on the environment, and avoid any material claiming to be leaked data. Contact your broker if you notice unfamiliar account activity.
More on this topicCybersecurityCloud ComputingSoftwareAI & Machine LearningTrending noweMudhra’s CA Keys Cracked: One Was the Number 4 [2026]Lynis Linux Security Audit in 13 Steps, 45 Min [2026]Keystone Key Theft: 18,835 Wallets Face Scrap [2026]GTA VI Survey: 10% Plan to Skip Work Launch Day [2026]GTA 6 Editions: $79.99 vs $99.99, 16 Extras [2026]
Elias VirtanenCybersecurity AnalystElias Virtanen is the Cybersecurity Analyst at Tech Insider, bringing hands-on expertise from his background in penetration testing and security consulting. He previously worked as a security researcher at F-Secure in Helsinki, where he focused on threat intelligence and vulnerability disclosure. Elias covers ransomware trends, zero-trust architecture, and the evolving regulatory landscape including NIS2 and the EU Cyber Resilience Act. He holds a CISSP certification and an MSc in Information Security from Aalto University.View all articles
The Tech Insider Newsletter
Industry insights, the latest tech news, and special interviews, every week.
One email a week. No spam, unsubscribe anytime.
Click Here For The Original Source.
——————————————————–
