GMO Internet tells Onamae.com customers to disconnect PCs after breach
Original title: Japan’s GMO Internet Urges Customers to Disconnect PCs
As many as 26,739 servers may be affected; GMO refused a ransom of about 8 billion yen and has not found ransomware on devices checked so far.
GMO Internet suspended its Onamae.com virtual desktop service on October 21 after finding malicious programs in some customer server environments the day before. An alert said information may have been accessed and up to 26,739 servers may be affected. Attackers demanded about eight billion yen ($50.7m) and, after GMO refused, said they would deploy ransomware at noon on October 27. GMO told customers to scan, back up, disconnect and power off PCs, and to ship machines for analysis. As of 11:59 on October 27, no malware, including ransomware, had been found on devices already examined.
Unconfirmed: Unauthorized trading is only suggested by some reports, and ransomware has not been found on analyzed devices.
- Onamae.com is a virtual desktop service used by foreign-exchange traders.
- The ransom demand was about eight billion yen, or $50.7 million.
- GMO says analysis is ongoing and not every customer device has been checked.
- Some reports suggest trading accounts were used for unauthorized transactions.
Impact: Malicious programs on customer servers; possible data and account access
| Product | Affected |
|---|---|
| GMO Internet Onamae.com | — |
- 1.Run a full virus scan, back up data, then disconnect the PC and turn it off.
- 2.Ship the PC to GMO Internet so its security team can investigate.
- Products
- Onamae.com
- Victims
- GMO Internet
- Countries
- Japan
From the original article
2 min read at infosecurity-magazine.com
GMO Internet has told customers to unplug their PCs in advance of a possible ransomware attack
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.