GMO Urges Onamae Desktop Cloud Customers to Shut Down PCs After Data Leak
Summary
GMO says data stolen in an intrusion at its Onamae Desktop Cloud was published online. It warned customers of possible malware on their servers and potential exposure of trading credentials; no ransomware activation was reported.
Key points
- GMO said it detected an intrusion on October 20 that could have affected up to 26,739 customer servers.
- The company confirmed that company and customer data had been stolen and published online; it was working to verify the leaked information.
- GMO said MT4/MT5 credentials and trading-account details may have been exposed, while payment information was not exposed.
- The attacker demanded ¥8 billion ($50 million); GMO said it would not pay and offered ¥5,000 ($30) per customer in compensation.
- GMO urged customers to disconnect and shut down their PCs while it scanned systems for malware and worked with Trend Micro on recovery.
- The article says no ransomware was activated on customer machines.
Article Details
- Victim Organization
- GMO Internet
- Incident Type
- Cyberattack involving data theft and publication, with a ransomware threat; no ransomware was activated on customer machines.
- Data Types Exposed
- Company and customer data; specific data types were not disclosed
- MetaTrader 4 and MetaTrader 5 credentials and trading-account details may have been exposed or compromised
- Affected Records
- Up to 26,739 customer servers were potentially affected by malware installation; no number of exposed records was disclosed.
- Operational Impact
- GMO shut down servers and reduced service availability during its investigation. It urged customers to disconnect and shut down their PCs, and offered equivalent replacements to customers whose PCs suffered ransomware damage.
- Ransom Or Extortion
- The attacker demanded ¥8 billion ($50 million). GMO said it would not pay and offered customers ¥5,000 ($30) for the inconvenience. The company confirmed that company and customer data had been published; no ransomware was activated on customer machines.
- Claim Status
- confirmed
Vendors
Products
MetaTrader 4internet company assured customers that their payment information had not been exposed but warned that MetaTrader 4 and MetaTrader 5 (MT4/MT5) credentials and trading-account details may have been exposed orMetaTrader 5assured customers that their payment information had not been exposed but warned that MetaTrader 4 and MetaTrader 5 (MT4/MT5) credentials and trading-account details may have been exposed or compromised.Onamae.com Desktop CloudThe GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today.