GMO Internet Group told users of its Onamae.com Desktop Cloud service to back up their files, disconnect their PCs from the network and switch them off after a threat to publish customer information and launch a ransomware attack at noon on October 27.

The Japanese internet infrastructure company said the warning followed a cyberattack on the remote Windows service, which is used for trading and other desktop work, and that some users had reported unauthorized activity in their accounts.

What GMO told users to do before noon

In its latest update, GMO said people who use the affected service should take several immediate steps: run a full antivirus scan, save important files while offline, and secure accounts from a separate device that is not connected to the compromised system.

The company also told users to end active sessions, change passwords and enable extra login protection where available. It warned that it does not ask customers for passwords or authentication codes, and said people should ignore any message demanding money to recover losses.

GMO’s warning came after it said attackers believed to be behind the breach had threatened to disclose customer information and carry out ransomware attacks. As of the latest check, the company said completed examinations of devices provided by users had not found malware, including ransomware, but it had not yet cleared every user’s device.

How the breach unfolded

GMO said it began investigating on October 19 after a customer inquiry, confirmed a malicious program on some customer server environments on October 20 and started shutting down servers the next day to stop further damage.

Masatoshi Kumagai, the company’s founder and chief executive, said the incident could affect 26,739 servers and involved unauthorized operations on trading accounts held with more than 70 securities and foreign-exchange firms in Japan and overseas. GMO has said customer information was taken and that some users saw transactions they did not recognize.

The company said it received a ransom demand from a party it believes was behind the attack. Kumagai later said the attackers demanded $50 million in cryptocurrency and threatened to release company and customer data. GMO said it refused to pay and is cooperating with police and other authorities.

Compensation and what comes next

GMO said it will compensate customers for losses from unauthorized trading linked to the attack. It also plans to give a ¥5,000 goodwill payment to every customer currently using the affected service, regardless of whether they suffered financial losses.

For users who want to keep using a Windows desktop environment, the company said it will offer an alternative service on independent cloud infrastructure free for six months. It also said it plans to overhaul its security architecture and investigate the breach further with outside specialists.

The latest update did not confirm that the threatened noon attack had actually taken place. But the company’s advice to cut network access and power down devices underlines how quickly the situation is still moving for customers who rely on the service to hold trading data and credentials.