Japan's GMO urges customers to shut down their PCs over ransomware threat

Japan's GMO Group has urged customers to disconnect their systems from the internet and shut down their computers. The warning came after an attacker who breached the Onamae Desktop Cloud service threatened to launch a ransomware attack that same day. The company later confirmed that both its own data and customer data had been published online.

Onamae Desktop Cloud is a popular VPS provider in Japan. It is operated by GMO Internet, a member of GMO Internet Group and one of the country's largest domain registrars.

Timeline

A week earlier, the company disclosed that it had detected an intrusion on October 20 that may have planted malware on the servers of up to 26,739 customers. To limit the risk, GMO shut down the servers, reduced service availability and opened an investigation.

The company said payment information had not been exposed, but warned that MetaTrader 4 and MetaTrader 5 (MT4/MT5) credentials and trading-account details may have been leaked or compromised. Customers were advised to reset their passwords and terminate active sessions.

Later updates confirmed that data had been stolen and that the attacker was demanding a ransom of ¥8 billion (about $50 million). GMO refused to pay and instead promised each customer ¥5,000 (about $30) in compensation for the inconvenience.

Instructions to customers

On October 26, GMO warned that the attackers planned to leak customer data and trigger a ransomware payload planted earlier on customer servers. The next day, the company asked users to disconnect their PCs from the internet, power them down and unplug all cables before noon. GMO is working with Trend Micro to recover from the attack.

"Once you have a backup, disconnect the network, power it down, and unplug the cord that connects to your PC," the company advised.

GMO said it was scanning customer systems for remaining malware and offered equivalent replacement PCs to anyone whose machine is damaged by ransomware.

A leak without encryption

In its latest report, the company confirmed that the attacker had published GMO and customer data, and said it is verifying the authenticity of the leaked information. For affected customers, GMO said it will consider additional financial compensation.

It appears the attacker never followed through on the threat: no ransomware was activated on customer machines. GMO warned the public and the media that it will take legal action against anyone who spreads the leaked information, and reaffirmed its refusal to pay the ransom.

Source: Bleeping Computer