GMO says hackers have published material claiming to be customer data; no ransomware attack confirmed

As of 8:41 a.m. ET, Oct. 27, 2026

GMO Internet Group said Tuesday that people it believes are the attackers behind a breach of its "Onamae.com Desktop Cloud" service have published material they claim is information about the company and its customers, after a noon Tokyo deadline passed with no payment.

In its 10th update on the breach, issued as of 1:55 p.m. Japan time on Oct. 27 (12:55 a.m. ET), GMO said it confirmed the publication at 12:30 p.m. Japan time and is reviewing what was posted. "There is a risk that it includes content that differs from the facts," the company said in the Japanese-language statement. (Quotes from GMO's statement are GROKsiNEWS.com translations.)

The attackers had also threatened a ransomware attack. GMO said that, as of 1:55 p.m. Japan time, a ransomware attack "has not been confirmed," and that it remains on alert.

"We will not comply with the attackers' demands," GMO said, adding that paying would not guarantee the stolen information is deleted or kept from misuse. The company said it has consulted the police and other authorities and is working with them.

Warning to customers

GMO told customers not to access or share the published material. It said information about anyone who visits the attackers' site is collected by the attackers, and that it cannot take responsibility for damage resulting from visiting it.

The company said it is preparing legal action, including disclosure requests in civil proceedings and criminal complaints, against people who spread the material in especially malicious ways. It said it will contact any customer individually if it confirms their information was in the posted material, and that an emergency meeting has begun considering compensation for those customers on top of a flat 5,000-yen payment announced earlier.

GMO also repeated its earlier requests: run a full virus scan, back up data, then disconnect affected PCs from the network, power them off and unplug cables. It warned of scam emails, text messages and calls impersonating GMO or authorities, and said it never asks for passwords or authentication codes.

GMO also asked news organizations to avoid excessive reporting that could cause further harm to customers.

What the attackers say

The Japan Times reported that the hacker group said in an online post that GMO was "not engaging in any negotiations" by the noon deadline and that it would therefore disclose personal information. The group vowed to keep leaking account holders' information one by one and threatened to disclose user data across more than 26,000 servers unless a $1 million ransom is paid, the newspaper reported. Those are the attackers' claims and have not been confirmed by GMO.

How the breach unfolded

According to GMO's timeline, the company suspended the service and received a threatening email on Oct. 21, consulted the police on Oct. 22, and on Oct. 24 announced payments to customers, compensation for losses from unauthorized transactions and a request to government agencies to apply active cyber defense measures. Its staff have been collecting customers' computers across Japan since Oct. 25, and its in-house security team is analyzing them, including whether malware or ransomware was actually planted. GMO said security companies, including Trend Micro, and AI companies have offered to help.

What is not known

GMO has not said whether the published material is genuine, how many customers it may cover, or whether any customer has been confirmed as affected. The ransom amount is unclear: GMO's own timeline describes the Oct. 21 threatening email as demanding about 8 billion yen, while the Japan Times reported a $1 million demand. It is not known whether the attackers will carry out the ransomware threat. GROKsiNEWS.com is not naming anyone whose data may have been posted and is not linking to the leak site.