GMO refuses $50M ransom as Onamae attacker leaks data

GMO Internet says the attacker behind the Onamae Desktop Cloud intrusion has published company and customer data, demanded ¥8 billion (about $50 million), and left a ransomware payload on customer servers that has not yet detonated. On 27 October 2026 GMO told Desktop Cloud users to disconnect affected PCs from the network, shut them down, and unplug the cables, and said it will not pay. We covered the initial breach when GMO shut the platform down on 21 October; this is the extortion phase.

What changed since the shutdown

GMO's Windows-focused VPS platform, popular for running MetaTrader 4 and 5 automated-trading bots around the clock, was taken offline on 21 October after malware was found across up to 26,739 customer servers. According to BleepingComputer, the attacker then demanded ¥8 billion, which GMO refused, warning the data would be leaked and a planted ransomware payload triggered. On 27 October GMO said the actor made good on the leak and published both company and customer data; the company is verifying its authenticity.

• GMO says no ransomware has been activated on customer machines so far — the shutdown guidance is to prevent detonation, not to recover from it.
• MT4/MT5 trading credentials and account details may be exposed; GMO tells customers to reset passwords and terminate active sessions.
• GMO maintains payment-card data was not exposed (held on separate infrastructure).
• GMO has reported the matter to police and, per reporting relayed by TNW, asked the Japanese state to use new active-cyber-defence powers to trace and neutralise the attacker's infrastructure. The actor also threatened to keep placing unauthorised orders through accounts at more than 70 securities and FX firms.

No group has claimed responsibility, and GMO has attributed the attack to no one. No IOCs or entry vector have been published. GMO has not posted its advisory at a stable public URL; this post is based on GMO's statements as relayed by the outlets above.

Action checklist

1. If you run a Desktop Cloud instance, follow GMO's guidance: back up what you need, then disconnect from the network, power down, and unplug the machine before reconnecting anything.
2. Treat every secret ever stored on the instance — MT4/MT5 logins, brokerage API keys, SSH keys, saved sessions, passwords — as exposed, and rotate from a clean host.
3. Review downstream brokerage and FX accounts for unauthorised orders, given the attacker's stated intent to trade through victim accounts.
4. Expect incident-themed phishing and extortion follow-ups. GMO says it will offer ¥5,000 per customer in compensation and equivalent PC replacements for ransomware damage — scammers will impersonate that process.

Context

This is the second large Japanese hosting incident to move from "intrusion" to "named-victim extortion with a published leak" this month, and the first where a provider has publicly asked Tokyo to invoke active-defence authority. The ¥5,000 goodwill payment against a ¥8 billion demand sets the tone: GMO is betting that refusing to pay and leaning on the state is cheaper than funding the operator. Whether the planted payload stays dormant now depends on how fast 26,739 servers get pulled off the wire.