GMO tells customers to disconnect PCs after cyberattack

GMO Group, the Japanese internet conglomerate, disclosed that it suffered a cyberattack in which threat actors installed malware on some customer environments. The report, drawn from DataBreaches[.]net’s summary of coverage, notes that GMO said the incident affected a substantial number of systems, with up to 26,739 servers reportedly at risk. In response, the company began a phased shutdown of affected servers, launched an investigation, and undertook cleanup efforts.

The original advisory included a stark instruction to customers: scan for viruses, back up all data, disconnect devices from the internet, and then shut them down—literally telling customers to unplug any cords connected to their PCs.

The entity making the public disclosure was GMO Group, with coverage corroborated through TechRadar reporting cited by DataBreaches[.]net. The date given for the initial disclosure is 20 October 2026, and the organisation outlined its remediation steps as it pursued containment and investigation. DataBreaches[.]net attributes the specifics of the malware installation and the scope of at-risk servers to GMO’s communications, as later reported by TechRadar.

The article does not provide CVEs, software versions, or technical exploitation details beyond the cited figures, and distinguishes between GMO’s confirmed actions and the threat actors’ activities as described in the company’s statement.