GMO Group issues ¥8 billion ransom demand after massive VPS breach
On October 27, 2026 the Japanese hosting firm GMO Group told every customer to pull the plug on their PCs, shut them down and disconnect from the internet.
The warning followed an intrusion discovered a week earlier, on October 20, 2026, that may have dropped malware onto as many as 26,739 virtual‑private‑server instances running the Onamae Desktop Cloud service.
What happened
GMO confirmed that the breach exposed internal company data and information belonging to its customers. The leak was later posted online, prompting the company to take the drastic “unplug‑and‑shut‑down” step.
Payment‑card details survived the breach, but the attacker obtained credentials for MetaTrader 4 and MetaTrader 5 platforms, as well as trading‑account information.
Ransom demand and response
The threat actor demanded ¥8 billion – roughly US $50 million – in exchange for not publishing further data. GMO offered a modest ¥5,000 (about US $30) compensation per affected customer and pledged to replace any PCs destroyed by a ransomware payload.
Despite the threat, GMO reported that no ransomware payload was ever activated on customer machines.
Impact and scope
- Potentially compromised: up to 26,739 VPS instances.
- Affected products: Onamae Desktop Cloud (VPS), MetaTrader 4, MetaTrader 5.
- Data leaked: internal company records and customer‑specific details, posted publicly.
Defensive steps for customers
- Immediately disconnect affected machines from the network and power them off.
- Change all passwords for MT4/MT5 accounts and any other services hosted on the VPS.
- Monitor financial accounts for unauthorized activity; report anomalies to your bank.
- Apply any patches or configuration changes supplied by GMO or your hosting provider.
- Consider using offline backups and multi‑factor authentication for future resilience.
GMO worked with Trend Micro to investigate the incident and is gradually restoring service while keeping customers informed.