GMO Internet warns customers after malware breach

GMO Internet’s Onamae[.]com service, a virtual desktop offering used by foreign‑exchange traders, was breached after malicious programs were found in some customers’ server environments. The firm suspended the service on 21 October after admitting that malware had been installed, potentially affecting information across its network of tens of thousands of servers.

An Onamae security alert said that as many as 26,739 servers could have been impacted, with some reports suggesting attackers accessed trading accounts and carried out unauthorized transactions. An extortion email dated 21 October demanded around eight billion yen ($50.7m). After refusing to pay, GMO Internet said the attackers warned they would deploy ransomware on 27 October at 12:00.

In response, GMO Internet advised customers to perform a full virus scan, back up all data, disconnect their PCs from the internet, and power them down. The firm requested that affected devices be shipped to its security team for investigation. By 27 October 11:59, the company stated that no malware, including ransomware, had yet been detected on devices analysed so far, though the investigation was ongoing and more devices were expected to arrive for analysis.

Commentators, including Suzu Labs chief security evangelist Phillip Wylie, noted that the breach demonstrates how a vulnerability in a remote access service can have consequences well beyond the initial system, emphasising the need to limit what attackers can do after gaining access. The incident adds to a recent spate of high‑profile breaches affecting Japanese firms.