Incident Response
GMO tells customers to unplug after cyberattack hits 26,000 servers
Japanese internet provider GMO urges customers to disconnect devices after hackers leak data and demand $1m ransom. Over 26,000 servers and trading accounts at risk.
Ross Grant3 min read
The short version
Hackers broke into GMO, a major Japanese internet provider, and claim to have stolen customer data from over 26,000 servers. They are demanding a $1 million ransom and have started leaking information online. GMO has told customers to unplug their computers and is working with police to investigate. The company says it will compensate anyone who loses money because of the attack.
By the numbers
- 26,739servers potentially affectedThe Independent
- $1mransom demanded by attackersThe Independent
- 70+securities firms and providers affectedThe Independent
- 5,000 Japanese Yen (£23)goodwill payment offered to affected customersThe Independent
What happened?
Japanese internet provider GMO has told customers to disconnect their computers after hackers began leaking allegedly stolen data from a breach affecting over 26,000 servers. The attackers are demanding a $1 million ransom and have threatened to keep publishing customer information. GMO has refused to pay, is working with law enforcement, and has promised compensation for confirmed losses. The full scale and authenticity of the leaked data are still under investigation.
Who is affected
Japanese internet services company GMO has said that a cyberattack has potentially affected 26,739 servers. These include servers used for clients’ trading accounts at more than 70 securities firms, foreign-exchange providers, and other businesses both in Japan and overseas. The company has not yet confirmed the exact number of customers whose information was compromised, but the scale covers a significant portion of its business clients and their end users.
What was taken
Hackers have started leaking information they claim was stolen from GMO and its customers. The company has acknowledged that some data has been published online, but is still checking whether all of it is genuine. The attackers have threatened to continue releasing personal information unless GMO pays a $1 million ransom. There are also reports of unauthorised transactions involving some customer trading accounts, raising concerns that financial data or access credentials may have been among the stolen information. GMO has promised to notify customers individually if their information is confirmed to be in the leaked material.
How the attack worked
The full details of how the attackers got in have not been made public. GMO is working with law enforcement and cybersecurity specialists to investigate how far the intrusion extended and whether malicious software was installed on customer devices. The company has urged customers to back up their data and disconnect their computers from the internet, a step that suggests the risk of ongoing compromise or malware spread. The attackers have set public deadlines for ransom payment and have posted online to pressure the company, but GMO has refused to negotiate.
The response
GMO disclosed the breach last week and has since been working with authorities to investigate. The company has refused to pay the ransom, stating that there is no guarantee the attackers would delete the stolen data even if paid. GMO has pledged to compensate customers for any confirmed financial losses from unauthorised transactions and has announced a goodwill payment of 5,000 Japanese Yen (about £23) for customers using the affected service. The company is also examining customer devices for signs of malware and will notify individuals if their data is confirmed to be in the leak.
Japan's prime minister, Sanae Takaichi, called an emergency meeting and said the incident is part of a series of major cyberattacks on Japanese organisations. She warned of growing concerns about civil damages from the misuse of leaked information and has asked the government to prepare new cybersecurity measures within a week.
What you should do
GMO has advised all customers to back up their data and disconnect their computers from the internet until more is known. Customers should watch for notifications from GMO about whether their information was affected, monitor their accounts for unauthorised transactions, and be alert for phishing attempts using leaked personal details. Businesses using GMO services should review their own security and consider additional monitoring for suspicious activity.
Claimed vs confirmed
- Confirmed
Hackers have published data allegedly stolen from GMO and its customers.
GMO confirmed that information claimed to be from the breach has been published online, but is still verifying its authenticity.
- Confirmed
Attackers are demanding a $1 million ransom and threatening to leak more data.
GMO and The Independent report the ransom demand and threats to release more information.
- Unconfirmed
There have been unauthorised transactions involving customer trading accounts.
The Independent reports concerns about unauthorised transactions, but GMO has not confirmed specific cases.
Why it matters
This breach affects a large number of customers and businesses, including financial trading accounts. The attack shows how ransomware groups can threaten both data privacy and financial security. It also highlights the need for strong incident response and public-private cooperation in cybersecurity.
Key points
- Hackers targeted GMO, affecting over 26,000 servers and many trading accounts.
- Attackers are leaking data and demanding a $1 million ransom.
- GMO has refused to pay and is working with law enforcement.
- Customers are urged to back up data and disconnect from the internet.
- The full impact and authenticity of leaked data are still being investigated.
Sources
The Independent
Reference
