TLDR
- GMO Internet Group told users to back up data and unplug computers before noon Tuesday after a hacker threat.
- The attackers demanded about ¥8 billion ($51 million), and GMO said it will not pay.
- The breach reached trading accounts at more than 70 securities and foreign-exchange firms.
- Five FX margin-trading services were breached, and unauthorized trades were made.
- After the deadline, the hackers said they released information on one client.
GMO Internet Group told account holders to back up their data and unplug their computers before noon on Tuesday. The warning came after a hacker group threatened to leak customer information and launch a ransomware attack.
BREAKING: GMO warns users to UNPLUG their computers before "NOON TODAY" as hackers threaten to unleash ransomware secretly planted on customers' PCs.
GMO refuses to pay the $50M ransom, warning there is no guarantee hackers will delete the stolen data and that they could use it… https://t.co/tJUCfWK2QL
— Bull Theory (@BullTheoryio) October 27, 2026
“Before 12 p.m. on Tuesday, Oct. 27, please back up (data), cut off the internet, shut down the computer and pull the plug connected to the computer,” GMO said in a statement.
Hackers demand ransom
The hacker group asked for about ¥8 billion ($51 million). GMO said it will not comply with the request.
The company said there is no guarantee the attackers would delete the personal information they took. It added that the stolen data might still be used for unlawful purposes.
GMO shares rose 1.7% on Tuesday. They had fallen nearly 16% in the previous session.
Breach hits trading accounts
Last week, GMO announced a security breach that may have affected 26,739 servers. The incident involved customer trading accounts at more than 70 securities firms, foreign-exchange providers and other businesses in Japan and overseas.
Investing.com reported that the attackers gained unauthorized access to the Onamae.com remote desktop platform. Customer data was breached, and unauthorized foreign exchange trades were carried out.
Some users lost nearly ¥2 million, according to early reports. Finance Minister Satsuki Katayama said on Tuesday that servers for five foreign exchange margin-trading services tied to GMO were breached.
The five companies are Goldenway Japan, Oanda, Ava Trade Japan, Gaitame Finest and Dukascopy Japan. They have suspended trades for the affected account holders.
GMO has pledged to compensate victims for their losses. Every user will also receive a ¥5,000 payout.
The company is analyzing some client computers to learn how the hackers got into the system. Cybersecurity and AI firms, including Trend Micro, are helping.
GMO CEO Masatoshi Kumagai wrote in a blog post on Sunday that the “internet itself is now on the verge of breaking down.” He urged the government to launch its cyberdefense measures.
Prime Minister Sanae Takaichi told her government on Monday to compile a package of cybersecurity measures by the end of next week.
After the noon deadline passed, the hacker group said it had released information on one client because GMO refused to negotiate, NHK reported.
