GMO Internet ransomware demand drops from $50 million to $1 million

GMO Internet Corp suffered a cyberattack that breached its virtual desktop infrastructure through a misconfigured cloud environment, according to SecurityOnline[.]info. The report states that the intrusion was enabled by an elementary cloud configuration oversight, with external actors seizing on the exposed infrastructure to exfiltrate customer archives and sensitive operational details.

The article cites GMO’s own corporate incident communications, claiming that external parties targeted thousands of hosted instances. The firm’s executives had reportedly refused extortion payments at the initial deadline, prompting the attackers to begin publishing the stolen data online.

Extortion demands subsequently plummeted, the piece notes, with the ransom cut from about fifty million dollars to one million dollars. The attackers asserted that a prompt payment would guarantee permanent deletion of the data and insisted they preferred a settled deal over “vindictive destruction”.

The piece also details what it describes as a failure to act on vulnerability reports: an anonymous informant allegedly provided a thorough technical vulnerability report directly to the attackers after corporate channels ignored dozens of urgent notifications. The informant purportedly hoped for a responsible disclosure reward via GMO’s bug bounty program, but the article states coordinators did not respond.

It also criticises internal security practices, describing bureaucratic silos and understaffing as factors that allowed external warnings to be discarded, ultimately enabling the breach.