
Japan's GMO Internet refuses ransom as hackers begin leaking customer data
Attackers who breached the Onamae.com Desktop Cloud started publishing stolen records after a noon deadline passed; no ransomware has been confirmed
TOKYO — GMO Internet, one of Japan's largest domain and hosting groups, is in a standoff with extortionists who broke into its Onamae.com Desktop Cloud service. The company found the intrusion on October 20. Up to 26,739 customer servers may have been affected, and some are used for foreign-exchange trading. GMO told customers to back up data and power down PCs before a noon deadline on Tuesday. The attackers then began leaking customer information one account at a time, and GMO has said it will not pay. Reports differ on the demand: BleepingComputer cites $50 million, while the Japan Times, citing Bloomberg, reports about $1 million. GMO says no ransomware has activated. It is offering each customer 5,000 yen and has asked Tokyo to treat the case as a first use of 'active cyber defense' powers. The attackers' identity is unconfirmed.
Why it mattersA large cloud provider's refusal to pay, and a government being asked to disrupt the attackers' infrastructure, could set a precedent for how extortion against critical IT services is handled.













