GMO Internet says it won't pay ransom after Onamae data leaks
The attacker posted data the company says is its own and its customers'. GMO urges people not to open it and says it has not confirmed ransomware.
GMO Internet Group, one of Japan's largest internet companies, says the attacker who broke into its Onamae.com Desktop Cloud virtual desktop service has posted data online that it claims belongs to the company and its customers. GMO confirmed the posting at 12:30 p.m. Tuesday, Japan time, and is still going through the material, which may include inaccurate data.
The company will not give in. "We will not comply with the attacker's demands," it said. An extortion email on Oct. 21 asked for about 8 billion yen, and GMO has gone to the police. Paying, it argues, would neither guarantee the data is deleted nor stop it from being misused.
What GMO is asking customers to do
GMO asks customers to not open or share the posted material, back up their data, disconnect and shut down their machines, and be wary of emails, texts or calls that claim to come from GMO. It says it never asks for passwords or authentication codes. Anyone whose data appears in the material will be contacted individually.
As of Tuesday afternoon, no ransomware (malware that encrypts computers to demand payment) had been confirmed. GMO is analyzing customer machines its staff collected, and Trend Micro joined that day as a security firm. The company has not said how many customers are affected or who the attacker is.
| Date | What happened |
|---|---|
| Oct. 19 | A customer raises a concern and GMO opens an investigation |
| Oct. 20 | GMO confirms an unauthorized program |
| Oct. 21 | Service is suspended and the extortion email arrives |
| Oct. 22 | GMO consults the police |
| Oct. 24 | GMO confirms customer data left its systems |
| Oct. 26 | The attacker threatens to post data and trigger ransomware at noon the next day |
| Oct. 27 | GMO confirms the posting at 12:30 p.m. |
Compensation
Onamae.com Desktop Cloud was also used to run trading platforms such as MetaTrader 4 and 5, which is why GMO plans to compensate unauthorized trades: 5,000 yen for each current customer and six months free on a replacement service. The notices do not mention users outside Japan.
Claims for losses are accepted through Nov. 6, and GMO says it will post any new findings on its notices page.
Keep reading
- Privacy
QNAP has no patch yet for critical PHP flaws in its NAS devices
- Artificial intelligence
OpenAI says its AI disproved the Exponential Time Hypothesis
- Artificial intelligence
Moonshot launches Kimi K3.1 Pro, promises open weights
- Gadgets
vivo V80 Lite 5G goes on sale in Mexico from about $696
