On October 27, GMO Internet said that people it believes to be the attackers had published information online that they presented as relating to the company and its customers. The company was checking the material and warned that it might be inaccurate. The following day, The Straits Times reported that the site had become inaccessible; that does not confirm the authenticity of the posted information.
The incident involves Onamae.com Desktop Cloud, a virtual desktop service. GMO had already confirmed unauthorized access to some customer server environments and the presence of a malicious program. It has not confirmed the ransomware attack threatened by the attacker.
What GMO confirmed
In its tenth notice, published October 27, GMO said it found information online at 12:30 p.m. that people it believed to be the attackers claimed was about the company and its customers. Its review was ongoing, and it warned that some statements might not match the facts.
GMO says it will contact affected customers individually if it confirms that their data appears in the material. It asked the public not to visit the site or spread what was published, to reduce the risk of secondary harm.
A ransomware threat is not confirmation
GMO said that as of 1:55 p.m. on October 27 it had not confirmed a ransomware attack. Its teams and partners were examining devices provided by customers. The company said the analysis was continuing and did not yet establish that every device was free of malware.
That distinction matters: an attacker’s threat, an alleged publication and a confirmed infection are different facts. The online material could be authentic, incomplete, mixed or false. Do not draw conclusions before GMO completes its review and contacts customers.
Steps GMO asked customers to take
GMO asks customers to run a full antivirus scan, back up their data and, following its instructions, disconnect and power off their computers. Affected customers should follow official updates and not reconnect a device before receiving instructions that apply to their case.
The company says it will not ask for a password or authentication code. Messages offering to recover losses for a fee or demanding a ransom may exploit anxiety about the incident. Verify any communication by going directly to GMO’s official site or support channel.
Reduce the risk from reused access
If a virtual desktop or connected device held credentials reused elsewhere, ask your IT team to assess their exposure. Rotate credentials from a device considered trustworthy and on the services where those credentials grant access. Do not reuse a replacement secret across accounts.
Preserve useful investigation evidence and record the instructions you receive. An antivirus scan on one device cannot by itself establish whether data was accessed from the provider’s systems or a third-party account was used.
Soclyde’s connection
A supplier incident can prompt a business to inventory its access and identify where secrets are used. Soclyde helps teams keep and share business access in an encrypted vault available on authorized devices. It does not protect Onamae environments, verify published files or replace GMO’s response instructions.
What to remember
GMO is checking information published by suspected attackers and had not confirmed ransomware as of its notice. Customers should follow official channels, apply device instructions and ignore requests for secrets or payment. To organise a team’s access, read our guide to creating secure passwords.
