# GMO Group Issues Emergency Shutdown Order Following Massive Data Breach Japanese tech giant mandates total device disconnection after ransomware threats and unauthorized trading activity. - **Source:** [Latest from TechRadar](https://www.techradar.com/feeds.xml) - **Published:** 2026-10-28 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/69c5349c-8855-40ec-9dc6-de0519139a1c ## Emergency Shutdown Protocol Initiated GMO Internet Group issued an urgent directive for customers to perform full virus scans, back up data, and physically unplug PCs. This extreme measure follows a severe cyberattack targeting the Onamae.com Desktop Cloud service. The company explicitly requested that all power cords be disconnected before the Tuesday, October 27 deadline. ## Scope of Infrastructure Compromise The breach impacted approximately 26,739 servers within the Onamae environment. Attackers successfully installed malicious programs, leading to unauthorized access across the platform. While the company began progressive shutdowns to contain the threat, the initial intrusion allowed malicious actors to extract sensitive customer data before the systems could be fully secured. ## Ransom Demands and Data Leak The unnamed threat actors demanded a $50 million ransom payment in exchange for the deletion of stolen data. GMO Group refused to comply with these extortion demands. Consequently, the attackers leaked the compromised information on the dark web. No specific entity has claimed responsibility for this large-scale cyber operation to date. ## Trading Platform Security Risks The attack specifically compromised login credentials for MetaTrader 4 and MetaTrader 5 users. Several customers reported unauthorized transactions within their trading accounts, signaling a direct financial impact. GMO Group has urged all affected users to reset their passwords immediately and terminate every active session to prevent further illicit account activity. ## Ransomware Threat Mitigation Efforts Although the attackers threatened to deploy ransomware across customer devices, no such software was ultimately detected on the servers. The company’s proactive shutdown order served as a defensive barrier against potential encryption. Investigators are currently analyzing the leaked data to determine the exact number of affected individuals and total risk. ## Compensation and Customer Support GMO Group announced a flat $30 compensation payment for all customers, regardless of whether they suffered direct damages. The company also promised separate, tailored compensation packages for users who experienced meaningful financial losses. Additionally, the firm is offering replacement computers to those whose hardware was potentially compromised during the security incident. ## Legal Stance on Leaked Data The company has issued a stern warning to the public and media outlets regarding the dissemination of leaked information. GMO Group stated it would pursue legal action against any parties found sharing the stolen data. This move aims to limit the secondary impact of the breach while the internal investigation continues. ## Long-term Operational Implications The full extent of material damages remains unknown as the investigation into the breach persists. This incident highlights the extreme vulnerability of automated trading environments hosted on VPS services. Moving forward, the company faces the challenge of restoring user trust while quantifying the substantial financial impact of this significant security failure. ## Sources covering this story - https://www.techradar.com/pro/security/japanese-internet-giant-gmo-tells-customers-to-shut-down-and-disconnect-pcs-from-the-internet-following-data-breach-and-ransomware-threat — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._