GMO Group Orders Cloud Shutdown After Ransomware Threat

Japan’s GMO Group told customers of its Onamae Desktop Cloud service to disconnect from the internet and shut down their computers on October 27 after a threat actor who breached the service threatened to launch a ransomware attack, BleepingComputer reported.

The guidance is the kind of emergency containment step that gets issued when an attacker still has an active foothold and the company does not yet have a clean network to restore into. Telling customers to power down their machines is a last-resort measure to stop lateral encryption before it starts.

What happened

Onamae Desktop Cloud is a virtual desktop service operated by GMO Internet Group, one of Japan’s largest internet companies. The threat actor claimed to have breached the service’s infrastructure and stated they would deploy ransomware if their demands were not met.

GMO’s public guidance instructed affected customers to:

• Disconnect their systems from the internet immediately
• Power off any computers connected to the service
• Avoid reconnecting until GMO issues an all-clear

The company did not disclose how the attacker gained initial access or what data, if any, was exfiltrated before the threat surfaced.

What to do if you are an Onamae Desktop Cloud customer

Follow GMO’s guidance: disconnect and shut down. Do not reconnect until you have confirmation from GMO that the environment is clean.

If you use Onamae Desktop Cloud for work files or internal business applications, treat anything accessed through that environment as potentially compromised until you have a clear statement from GMO. Change any credentials used in that environment from a separate, unaffected device.

Watch for a formal incident disclosure. Japanese companies are required to notify customers of personal data breaches under the Act on the Protection of Personal Information. If personal or business data was accessible through the compromised environment, a notification should follow.

Context

This is not an isolated incident for Japan’s cloud hosting sector. In October 2026, IDCF Cloud, another Japanese cloud provider, suffered a ransomware attack that affected 194 customers and knocked out government systems. The pattern: attackers compromise a shared cloud infrastructure, then threaten or deploy ransomware against the provider’s downstream customers.

Shared infrastructure is a force multiplier for ransomware operators. A single breach can hold dozens or hundreds of customer environments hostage at once, which is precisely why threat actors have been targeting managed service providers and cloud platforms. The attack on GMO fits that playbook.

For any organization running workloads on third-party hosted desktops or managed cloud environments: confirm your vendor has tested ransomware incident response, verify you have offline backups of anything critical, and make sure you have a contact channel that does not depend on the potentially compromised environment itself.

Related: AI Agents Ran INC and Gentlemen Ransomware Intrusions, Teams IT Support Scams Deploy Ransomware at Scale