Japan's GMO Group, one of the country's largest domain registration companies, has issued a stern warning to its customers to disconnect their systems from the internet and shut down their computers completely. This extraordinary measure comes after the Onamae Desktop Cloud service (a popular provider of virtual private server services) suffered a security breach, where attackers threatened to carry out a ransomware attack and leak sensitive data.
Details of the breach and financial demands
The company confirmed that the attackers succeeded in accessing data belonging to both the company and its customers, and have already published some of this data online. The attackers demanded a massive ransom of 8 billion Japanese yen (equivalent to approximately 50 million US dollars), but GMO Group announced its categorical refusal to pay any money to the attackers.
The company had previously detected (on October 20) an intrusion that may have led to the installation of malicious software on the servers of up to 26,739 customers. Although the attack has not yet escalated to activating ransomware on user devices, the risk of a pre-planted malicious "payload" remains, necessitating rapid intervention.
What should users do?
Given the seriousness of the situation and the potential for trading data to be compromised, the company provided strict technical instructions to mitigate risks:
- Disconnect devices: Completely disconnect computers from the internet and unplug power cables.
- Secure accounts: Immediately change passwords, especially for users of MetaTrader 4 and MetaTrader 5 (MT4/MT5) platforms, as their trading credentials may have been compromised.
- Terminate sessions: Close all active sessions to ensure no existing access is exploited.
The company advised customers to back up their data before performing the disconnection and shutdown process.
Compensation and corrective steps
To mitigate the crisis, GMO announced it would provide financial compensation of 5,000 yen (about 30 dollars) to each affected customer for the inconvenience caused by the service disruption, with a promise to consider additional compensation for those whose data is proven to have been compromised. The company also offered to replace computers for customers who might be physically affected by a ransomware attack.
The company is currently working in cooperation with Trend Micro, a cybersecurity specialist, to inspect and sanitize the systems, while threatening to take legal action against any entity or media outlet that publishes the leaked data.