GMO Group mijozlardan tizimlarini internetdan uzib, kompyuterlarini o'chirishni so'radi, chunki kompaniyaning Onamae Desktop Cloud tizimiga kirgan tahdidchi bugun ransomware hujumini boshlash bilan tahdid qilgan.
Keyinchalik kompaniya o'ziga va mijozlariga tegishli ma'lumotlar internetda e'lon qilinganini tasdiqladi.
Ogohlantirish GMO Internet Group a'zosi va Yaponiyaning eng yirik domen registratorlaridan biri bo'lgan GMO Internet tomonidan boshqariladigan, Yaponiyada mashhur VPS provayderi Onamae Desktop Cloud tizimiga qilingan kiberhujumga tegishli.
O'tgan hafta kompaniya 20-oktabrda aniqlangan kirish 26 739 ta mijoz serveriga zararli dastur o'rnatishi mumkinligini e'lon qildi.
Xavfni kamaytirish maqsadida kompaniya serverlarni o'chirdi va xizmat mavjudligini kamaytirdi, so'ngra tekshiruvni boshladi.
Internet kompaniyasi mijozlarga ularning to'lov ma'lumotlari oshkor bo'lmaganini kafolatlagan, ammo MetaTrader 4 va MetaTrader 5 (MT4/MT5) ma'lumotlari va savdo hisoblari tafsilotlari oshkor bo'lishi yoki buzilishi mumkinligini ogohlantirgan. U mijozlardan parollarini qayta o'rnatish va faol sessiyalarni tugatishni so'radi.
Kiberhujumning kuchayishi
Kompaniyaning keyingi yangilanishlari ma'lumotlar o'g'irlanganini va hujumchi ¥8 milliard ($50 million) to'lov talab qilganini tasdiqladi, GMO esa buni to'lamasligini aytdi. Buning o'rniga kompaniya har bir mijozga noqulaylik uchun ¥5 000 ($30) kompensatsiya berishini e'lon qildi.
26-oktabrda GMO tahdidchilar mijoz ma'lumotlarini internetda tarqatish va hujumning avvalgi bosqichida mijoz serverlariga o'rnatilgan ransomware yukini ishga tushirishni rejalashtirganini ogohlantirdi.
Ertasi kuni kompaniya mijozlardan kompyuterlarini internetdan uzib, o'chirishni va tushgacha barcha kabellarni ajratishni so'radi, shu bilan birga Trend Micro bilan kiberhujumdan tiklanish ustida ishladi.
"Zaxira nusxasi bo'lgach, tarmoqni uzing, quvvatni o'chiring va kompyuteringizga ulangan kabelni ajrating," deb mijozlarga maslahat berdi GMO.
Mijozlarga ko'rsatmalar Manba: GMO
Kompaniya mijoz tizimlarini skanerlash orqali zararli dastur hali ham mavjudligini aniqlash ustida ishlayotganini va ransomware hujumidan zarar ko'rganlarga teng qiymatli kompyuter almashtirishni taklif qilganini aytdi.
Bugun ertaroq e'lon qilingan hisobotda GMO tahdidchi kompaniya va mijoz ma'lumotlarini e'lon qilganini tasdiqladi, bu esa oshkor qilingan ma'lumotlarning haqiqiyligini tekshirishga undadi.
Ma'lumotlari oshkor bo'lgan mijozlar uchun GMO qo'shimcha moliyaviy kompensatsiya berishni ko'rib chiqishini aytdi.
Ko'rinishicha, hujumchi tahdidini amalga oshirmagan, chunki mijoz mashinalarida hech qanday ransomware faollashtirilmagan.
Kompaniya odamlar va ommaviy axborot vositalaridan oshkor qilingan ma'lumotlarni tarqatmaslikni so'radi va buni qilganlarga nisbatan huquqiy choralar ko'rishini e'lon qildi, shu bilan birga hujumchilarga to'lov qilmasligini yana bir bor tasdiqladi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% to'xtatiladi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalangach, oldini olish keskin pasayadi.
Blue Report 2026 mijoz ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnikadan texnikaga mudofaa choralarini o'lchaydi.
Hisobotni oling
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today.
The company later confirmed that data belonging to both the company and its customers had been published online.
The alert concerns a cyberattack on Onamae Desktop Cloud, a popular VPS provider in Japan operated by GMO Internet, a member of GMO Internet Group and one of Japan's largest domain registrars.
Last week, the company announced it detected an intrusion on October 20 that could have installed malware on up to 26,739 customers' servers.
To minimize the risk, the company shut down the servers and reduced service availability before launching an investigation.
The internet company assured customers that their payment information had not been exposed but warned that MetaTrader 4 and MetaTrader 5 (MT4/MT5) credentials and trading-account details may have been exposed or compromised. It urged customers to reset their passwords and terminate active sessions.
Cyberattack escalation
Subsequent updates from the company confirmed that data had been stolen and that the attacker was demanding a ransom of ¥8 billion ($50 million), which GMO said it would not pay. Instead, the company announced it would compensate each customer ¥5,000 ($30) for the inconvenience caused.
On October 26, GMO warned that threat actors planned to leak customer information online and trigger a ransomware payload planted on customer servers earlier in the attack.
The next day, the company asked customers to disconnect their PCs from the internet, shut them down, and unplug all cables before noon, while it worked with Trend Micro to recover from the cyberattack.
“Once you have a backup, disconnect the network, power it down, and unplug the cord that connects to your PC,” advised GMO to customers.
Instructions to customers Source: GMO
The company said it was scanning customer systems to determine whether malware was still present, and offered equivalent PC replacements to those who suffered damages from a ransomware attack.
In a report published earlier today, GMO confirmed that the threat actor had published company and customer data, prompting efforts to verify the authenticity of the leaked information.
For customers whose information was exposed, GMO said it will consider additional financial compensation.
It appears that the attacker never acted on their threat, as no ransomware was activated on customer machines.
The company warned people and the media not to disseminate the exposed information, announcing it will take legal action against those who do, while reaffirming its refusal to pay the attackers.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report