Japan's GMO Internet Group told users of its Onamae service to back up their data, shut down their computers and disconnect them from the network and power supply before noon on Tuesday 27 October, Japan time, after suspected attackers threatened to release customer information and launch a ransomware attack at midday. The company said it would not pay the reported $50 million ransom and would not comply with the attackers' demands.

The breach behind the warning

Late last week, GMO disclosed a major cyber attack that gave unauthorised access to its Onamae.com remote desktop platform, breached customer data and led to unauthorised foreign-exchange trades being executed. The company said it would reimburse customers for losses from the incident, and it has been working with police while its specialists analyse computers collected from customers to establish whether malware, including ransomware, was planted.

What happened at the deadline

In its latest status update reported on Tuesday, GMO said no ransomware attack had been confirmed. That is a point-in-time statement, not a clearance, and customers should keep checking official updates. Shares in the company rose 1.7% on Tuesday after tumbling nearly 16% in the previous session.

Sources: Investing.com reporting carried by Europe Says; Japan Cyber Watch, 27 October 2026.