Communications ministry orders ISPs to block hacker site after GMO data breach

Japanese internet giant GMO has instructed its customers to shut down their computers and disconnect them from the internet following a recent data breach and ransomware threat. The conglomerate, which operates in various sectors including cybersecurity and financial services, advised users to scan their devices for viruses, back up all data, and disconnect network and power from their PCs.

The warning came after the company disclosed a cyberattack on October 20, 2026, in which threat actors allegedly stole customer data and installed malware on some servers. Up to 26,739 servers were at risk, and the attackers demanded around $50 million in ransom in exchange for deleting the stolen information. The data was eventually leaked, but no group claimed responsibility for the attack.

Despite the data leak, no specific entities were held accountable. In addition to the data breach, the attackers threatened to install ransomware on customer devices, prompting the company's warning to shut down and unplug all devices. Onamae, a popular VPS service provider, has compensated all customers $30 for their troubles, while offering replacement computers to those affected.

The company's investigation is ongoing, and the full scope of the attack and any material damages remain to be determined.