Japanese ISP GMO Internet suffers major data breach and ransomware demand

What happened

As detailed in The Register, Japanese internet service provider GMO Internet has confirmed a significant security breach affecting its Onamae.com Desktop Cloud service. Ransomware , Threat Intelligence Japanese ISP GMO Internet suffers major data breach and ransomware demand October 27, 2026 Share By SC Staff (Adobe Stock Images) As detailed in The Register, Japanese internet service provider GMO Internet has confirmed a significant security breach affecting its Onamae.com Desktop Cloud service.

CEO Masatoshi Kumagai admitted that internal security teams had previously identified vulnerabilities, but the company failed to address them with sufficient speed. In response, the firm is offering compensation to affected users and has proposed a national proactive cyber defense strategy to the Japanese government.

The attack involved unauthorized access to virtual desktop infrastructure, potentially compromising 26,739 servers. Attackers installed malicious software, leading to unauthorized trading activity on customer accounts.

The perpetrator has demanded $50 million in ransom, threatening to leak sensitive company and customer data if the payment is not made. The company is currently working with trading platforms to terminate active sessions and block traffic from the affected cloud environment.

The incident highlights the growing threat of AI-driven cyberattacks, with GMO reporting the misuse of autonomous penetration testing tools. The breach underscores the critical need for rapid vulnerability remediation in cloud-based services to prevent large-scale exploitation by malicious actors. Source: The Register An In-Depth Guide to Ransomware Get essential knowledge and practical strategies to protect your organization from ransomware attacks.