Full Breakdown
GMO Internet Group Cyberattack: Data Leak, Ransom Demand, and Ongoing Response
By Drooid · · How we work
In this breakdown
01
Incident Overview
Japanese internet service provider GMO Internet Group confirmed that a hacker-operated website displaying alleged customer data was taken offline on October 27. The site had posted personal details that the victim described as “partially correct and partially wrong.” The Metropolitan Police Department placed the affected customer under protection and asked GMO to assess the breach, which authorities are treating as a suspected violation of Japan’s unauthorised-computer-access law.
02
Timeline of Key Actions
- October 20 – An investigation after a customer inquiry found an unauthorised program installed on some customers’ server environments.
- October 21 – GMO shut down its Onamae.com Desktop Cloud service after detecting the unauthorised access.
- October 22 – The company reported the incident to Japanese police and issued a public update.
- October 24 – GMO announced compensation and alternative services while seeking assistance from government agencies.
- October 25-26 – Devices were collected from customers to detect malware and gauge damage.
- October 26 – GMO disclosed that the hacker threatened to release customer information and launch a ransomware attack at noon on October 27.
- October 27 – The hacker posted a statement and personal data, warning of daily releases until a ransom was paid. GMO confirmed the website domain was taken down later that day.
- October 28 – GMO reported that the hacker-run site had become inaccessible.
03
Response and Mitigation Measures
GMO announced a bounty of up to $1 million for information leading to the arrest of the attackers and launched a dedicated website to collect leads on the perpetrators, the infrastructure used, and any related financial flows. The company warned that new sites could appear and said it would consider legal action, including filing criminal complaints, against anyone directing traffic to the attackers’ domain. GMO also urged customers to reset passwords after reports of “unauthorised operations” on trading accounts.
The firm has asked the Japanese government to adopt active cyber-defence measures; the government declined to comment on specific actions, citing security concerns. The Metropolitan Police Department continues protective measures for affected clients.
04
Data & Statistics (Conflicting Reports)
- Server impact – One source reports the breach may affect more than 26,000 servers, while another estimates 27,000 servers could be compromised.
- Ransom demand – The hacker group demanded a $1 million ransom, yet a separate report cites a demand of 8 billion yen (? $50 million).
05
Ongoing Investigation and Next Steps
GMO is working with police to trace the attackers and has pledged to shut down any revived domains promptly. The company will continue monitoring for further data releases and is coordinating with the Financial Services Agency, which previously issued guidance urging stronger cybersecurity controls for financial institutions. No additional legal or regulatory actions have been announced at this stage.