GMO Onamae Desktop Cloud attackers publish what they say is company and customer data after GMO refuses an ¥8 billion demand; no ransomware has triggered yet, and GMO launches a $1 million bounty
The attackers behind the Onamae.com Desktop Cloud breach had told GMO Internet they would leak customer data and set off ransomware at noon JST on Oct 27 (11 PM ET Oct 26). GMO's reports that day:
- Before the deadline (8th and 9th reports): GMO asked customers who had connected to the service to back up their data, then disconnect their PCs from the network, power them off and unplug them before noon. Its own team, working with Trend Micro among others, had found no malware, including ransomware, on the customer devices analyzed so far, while stressing that not every device has been checked. GMO offers a replacement PC of equal spec to anyone hit by ransomware.
- The leak (10th and 11th reports): at 12:30 JST GMO confirmed the attackers had published material they claim is GMO and customer data. GMO is checking it and warns it may contain false content. It says visitors to the leak site have their own details collected by the attackers, asks people not to visit or share it, tells anyone who already did to run a full antivirus scan, and is preparing legal action against people who spread the data. As of 13:55 JST no ransomware attack had been confirmed.
- Money (12th report): GMO says it will "never" pay. Customers whose data appears in the leak get a special payment per category exposed: ¥10,000 for basic contact details, ¥15,000 for trading-account IDs, passwords and other financial or login data, ¥25,000 for sensitive personal data (capped at ¥3 million), on top of the earlier ¥5,000 and loss compensation. GMO Internet Group also created the GMO Cybercrime Bounty: up to $1 million in total for verifiable, lawfully obtained information that identifies those involved, with submissions opening at cybercrimebounty.gmo at noon JST on Oct 28 (11 PM ET Oct 27). It asks people not to hack, contact or chase the attackers themselves.
If you used the service: follow GMO's earlier steps from a clean device: sign out every session with each broker, change FX, brokerage, email and Google passwords, turn on MFA, remove unknown linked apps, forwarding rules and extensions, and keep browser sync off until devices are checked. Expect phishing and "recover your losses" scams that use the leaked data; GMO says it will never ask for passwords or codes.
Sources: GMO Internet: 10th report, attacker publication of data (Oct 27 13:55 JST, Japanese) · GMO Internet: 11th report, request not to spread leaked data (Oct 27 14:55 JST, Japanese) · GMO Internet: 12th report, special compensation and $1M GMO Cybercrime Bounty (Oct 27 19:10 JST, Japanese) · GMO Internet: 9th report, no malware found on analyzed devices so far (Oct 27 11:59 JST, Japanese) · GMO Internet: 8th report, request to back up and power off PCs before noon (Oct 27 09:58 JST, Japanese) · BleepingComputer: Japan's GMO urges customers to shut down PCs amid ransomware threat (Oct 27)