Japanese Hosting Giant Tells Customers to Unplug PCs After Breach and Ransom Threat

GMO Internet, a Japanese provider, has told customers of its Onamae.com virtual desktop service to disconnect their machines from the internet after a breach. The service runs on tens of thousands of servers and is popular with foreign-exchange traders. The company suspended it on October 21, after discovering the day before that malicious programs had been installed in some customers' server environments. A security alert said some information may have been accessed and that as many as 26,739 servers may have been affected. Some reports suggest attackers may have accessed trading accounts and made unauthorised transactions.

An extortion email sent on October 21 demanded around eight billion yen ($50.7m). GMO Internet refused to pay, and the attackers then said they would deploy ransomware at 12pm on October 27. The company advised customers to run a full virus scan, back up their data, disconnect their PC from the internet and turn off the power. It also asked customers to ship their PCs to its security team for investigation. As of October 27, 11:59, no malware, including ransomware, had been found on the devices analysed, but analysis is continuing and not all devices have been checked.

Phillip Wylie of Suzu Labs said the case shows how a weakness in a remote access service can have consequences far beyond the compromised system. He noted that attackers can apply pressure by stealing data, compromising accounts and threatening to leak information, even without deploying ransomware. He stressed that limiting what attackers can do after gaining access is as important as preventing the initial compromise.