Japanese internet service provider GMO Internet Group (Tokyo Stock Exchange: 9449) issued an urgent security warning on October 27 to users of its Onamae.com service, stating that hackers are threatening to publish customer personal information at noon that day and launch a ransomware attack.
The company instructed affected users to back up their data before the specified time, shut down their computers, and disconnect from both network and power connections.
Previously, GMO disclosed that Onamae.com's remote desktop service had suffered a major cyberattack, resulting in customer data leaks and unauthorized foreign exchange transactions.
GMO stated it will compensate customers for losses incurred as a result, while refusing to pay the $50 million ransom demanded by the hackers.
Hackers Threaten Noon Ransomware Attack, GMO Urges Users to Disconnect Urgently
In a statement published on its official website, GMO said it received notice from a suspected attacker claiming they would release customer information at noon on October 27 and initiate a ransomware attack.
To prevent potential losses, GMO required users of relevant Onamae.com accounts to complete data backups before noon that day, then shut down their computers, disconnect from the network, and cut power to their devices.
This warning indicates that GMO believes the previously occurring network intrusion may escalate further.
However, the hackers have so far only issued an attack threat, and it cannot yet be determined that the related ransomware attack has actually occurred, nor can it be confirmed whether the customer information they hold will be published as threatened.
Remote Desktop Platform Previously Breached, Customer Data Leaked and Abnormal Forex Trades Occurred
This emergency warning stems from a major cybersecurity incident GMO disclosed last week.
According to the company's earlier statement, hackers gained unauthorized access to the Onamae.com remote desktop platform, resulting in the leak of some customer data.
More seriously, the attack also involved foreign exchange transactions executed without customer authorization.
This means the impact of the network intrusion is not limited to personal information security but has also created actual financial transaction risks.
GMO stated it will compensate affected customers for related losses.
However, the company has not yet disclosed in this report the number of affected users, the specific scope of leaked data, or the total losses caused by the abnormal forex transactions.
GMO Refuses to Pay $50 Million Ransom, Stock Rebounds After Sharp Drop
According to reports, hackers demanded a $50 million ransom from GMO, but the company made clear it will not pay and will not act in accordance with the attackers' demands.
Amid the ongoing cybersecurity incident, GMO's stock price had plunged nearly 16% on the previous trading day, reflecting investor concerns over customer data leaks, potential liability for compensation, and risks to business operations.
On October 27, GMO's stock price rose about 1.7%, showing a certain rebound after the previous sharp decline.
Currently, GMO has taken urgent user protection measures, but the related security incident is not yet over.
Going forward, attention needs to be paid to whether the hackers carry out their threat, whether the company can prevent further data leaks, and the scale of customer compensation involved in the abnormal forex transactions.
Comments