GMO Internet urges customers to disconnect systems after server breach

Japanese service provider GMO Internet has urged customers of its Onamae Desktop Cloud service to disconnect their systems from the internet and shut down their computers. BleepingComputer and The Tokyo Reporter both reported that the company issued the warning after hackers breached the virtual private server platform and threatened to launch a ransomware attack. GMO Internet later confirmed that stolen data belonging to the company and its customers had been published online, according to BleepingComputer and TechCrunch. [1][2][8]

Outlets gave differing reports on the financial demands made by the intruders. BigGo Finance and The Tokyo Reporter both reported that the hackers demanded a $1 million ransom after breaching the provider. Cryptopolitan reported that the hackers made a $50 million demand, which GMO Internet refused. BigGo Finance added that the hackers threatened to leak customer information after the company rejected the $1 million ransom demand. [4][6][8]

GMO Internet Group, Inc. is an internet company listed on the Tokyo Stock Exchange with headquarters in Shibuya, Tokyo, Japan. As FTMQ Security reported earlier, Onamae Desktop Cloud previously suspended operations on October 21, 2026, after unauthorized access was detected on October 20, 2026. That earlier intrusion affected up to 26,739 customer servers after hackers installed malicious programs on the infrastructure. [9][10]

Reports from BleepingComputer, Yahoo Finance UK, Nikkei Asia, and 조선일보 confirmed that the cyberattack continues to pose ongoing operational risks to GMO Internet customers. 조선일보 reported that the company faces daily threats of data leaks following the intrusion. [1][3][5][7]