JP — ITmedia

GMO to Provide New PCs to Customers Hit by Ransomware; Criminal Group Reportedly Publishes One Customer's Data

SecurityOctober 27, 20262 min read

GMO Internet Group said it will give customers whose PCs were hit by ransomware a new computer with the same performance. This comes after hackers attacked its "Onamae.com Desktop Cloud" service and posted one customer's personal data online.

What happened

GMO Internet Group said that customers of its "Onamae.com Desktop Cloud" service, whose PCs were hit by ransomware after an unauthorized access, will receive a new PC with the same performance. GMO said the PCs it has already collected and analyzed did not show ransomware or other malware as of 11:59 a.m. on October 27. At noon the same day, the hacker group posted what it said was one customer's personal information on its website. GMO said it is still checking this information, but warned that it may contain false details. It asked people not to visit the hackers' site or share the content.

Key numbers and facts

Deadline for the hackers' threat: noon on October 27, 2026.
Hackers said they got into customers' local PCs by using a weakness in the Desktop Cloud service.
GMO staff visited customers across Japan to collect their devices.
Customers with ransomware damage can contact GMO's support desk to get a new PC.

Background

The hacker group said it would leak customer data or encrypt customer PCs with ransomware if GMO did not pay money by noon on October 27. Ransomware is a type of harmful software that locks files so the owner cannot use them until a payment is made. GMO said a team of white-hat hackers, meaning security experts who test systems to find and fix weak points, was studying the devices. Security companies such as Trend Micro and some AI companies have also offered to help. GMO is still working out how they will help.

Why it matters

This case shows how a weakness in a cloud service can put many customers at risk at once. Customers may lose data, and the leak of personal information can cause harm even if the posted data turns out to be false. Asking people not to spread the hackers' content is also important, because sharing it can hurt the people named in it.

What to watch

Whether GMO confirms or denies the posted personal information.
How many customers are affected and how many new PCs GMO will provide.
Which companies will help GMO, and what their role will be.
Whether the hacker group carries out more leaks or attacks.

Same story, different eyes

The SkepticAI

Fresh PCs for victims, and a cue for what to verify next

Offering equivalent replacement PCs is a reassuring step, and the report that analyzed devices showed no malware as of 11:59 is useful too.

Read the full take in the app →

The UserAI

A replacement PC offer shows how a cloud desktop breach can reach your own machine

If you use a cloud desktop service for work, this is a reminder that a breach on the provider's side can touch the PC sitting on your own desk.

Read the full take in the app →

Japan to draft emergency cyber defense package next week; PM Takaichi orders it at first ministerial cybersecurity meeting

At the first meeting of the cabinet ministers' council on cybersecurity on October 26, Prime Minister Sanae Takaichi said the government aims to compile an emergency countermeasure package by next week, including fiscal measures, after a series of cyberattacks on Japanese companies. The package covers stronger active cyber defense measures such as "access and neutralization" of attack servers, accelerated vulnerability checks on government systems, and expanded support for victim companies, especially small and medium-sized businesses.

SecurityThe RegisterOct 27

Japanese virtual desktop cloud hacked so hard it asks to be banned

GMO Internet warned customers that its Onamae.com Desktop Cloud, a virtual desktop service it recommended for foreign exchange trading, was compromised by an attacker and that it had been slow to improve the service's security. The company says an attacker demanded $50 million, which GMO has refused to pay, and that 26,739 VDI servers may have been affected. GMO is offering customers a ¥5,000 condolence payment and has advised users to change trading passwords and disconnect active sessions.

SecurityITmediaOct 27

JR Smart EX and Express Reservation member email addresses possibly leaked, about 170,000 records, after unauthorized access to Yumilink

JR Tokai, JR West, and JR Kyushu announced on October 26 that some member email addresses, member IDs, names in katakana, and membership types for their Express Reservation and Smart EX services may have leaked. The number of affected records is still being confirmed, but they have reportedly received a preliminary figure of about 170,000. The leak stems from unauthorized access to Yumilink, the provider of the mail delivery service, and JR Tokai has not confirmed any leak from its own systems for either service.