GMO Internet Refuses a 50 Million Dollar Ransom After a Breach Hit 26,739 Servers

GMO Internet Confirms a Major Breach

Japanese internet service provider GMO Internet has confirmed a significant security breach affecting its Onamae.com Desktop Cloud service, and the details are grim. According to reporting in The Register, summarised by SC Media on October 27, 2026, attackers gained unauthorised access to virtual desktop infrastructure, potentially compromising 26,739 servers. They installed malicious software, leading to unauthorised trading activity on customer accounts. The attacker has demanded 50 million dollars in ransom, threatening to leak sensitive company and customer data if the payment is not made.

GMO has refused to pay, saying there is no guarantee that stolen information would be secured even after payment. That is the right call, and it is also a hard one. Refusing a ransom means accepting that stolen data may be published, and it puts the company in the uncomfortable position of telling customers that their information may be exposed while also telling them that paying would not fix the problem. GMO is working with trading platforms to terminate active sessions and block traffic from the affected cloud environment, and it is offering compensation to affected users.

What Went Wrong at GMO Internet

The most damaging detail is not the ransom demand, it is the admission that came with it. CEO Masatoshi Kumagai admitted that internal security teams had previously identified vulnerabilities, but the company failed to address them with sufficient speed. That sentence should worry every company running cloud infrastructure. Most breaches are not caused by a brilliant new attack. They are caused by a known weakness that sat in a backlog while other work took priority, until an attacker found it first.

GMO also reported misuse of autonomous penetration testing tools, which points to a newer threat: AI-driven attacks that can probe, adapt, and move faster than a human attacker working alone. That does not mean AI is unstoppable. It means the old model of patching on a quarterly cycle is even less defensible than it was. If attackers can automate discovery and exploitation, defenders have to automate patching, monitoring, and isolation too, or the gap between discovery and fix becomes the attack window.

Why the GMO Internet Breach Matters Beyond Japan

A breach at an internet service provider is different from a breach at a single company, because the provider sits underneath many customers. Virtual desktop infrastructure is supposed to isolate customers from each other. When that isolation fails at this scale, the blast radius is not one business, it is thousands of servers and the trading accounts connected to them. That is why GMO's proposal of a national proactive cyber defence strategy to the Japanese government matters, even if it sounds like a policy talking point. ISPs and cloud providers are critical infrastructure, whether or not they are formally labelled that way.

The incident also fits a pattern from this month. SafePay ransomware has hit more than 600 critical infrastructure organisations, according to a joint CISA and FBI advisory covered in our SafePay ransomware warning, and new extortion groups are claiming victims almost daily. The GMO case is different in one respect: it is a confirmed breach with a named provider and a public ransom refusal, not an unverified leak-site claim. That makes it a clearer lesson. For what to do if your own data is caught in a breach, see what to do after a data breach.

What Customers and Companies Should Do Now

If you use a virtual desktop or cloud service, the GMO breach is a reminder to check three things today. First, make sure your account has multi-factor authentication turned on, and that it is not SMS-only where a stronger option exists. Second, review active sessions and revoke any you do not recognise, especially on trading or financial accounts. Third, assume that any data stored in a breached service could be published, and change passwords that were reused anywhere else.

For companies, the lesson is about speed. Vulnerability management needs a clock, not just a list. Known vulnerabilities in internet-facing or multi-tenant systems should have a fixed remediation deadline, with escalation when that deadline slips, and the CEO should know about the slip before an attacker does. GMO's team found the weaknesses. The failure was not detection, it was follow-through. That is a management problem, and it is fixable, but only if leadership treats patching as a business risk, not an IT chore.

The Bottom Line

GMO Internet refused to pay 50 million dollars, and that refusal deserves credit, because paying ransoms funds the next attack and rarely guarantees data deletion. But refusal is not a strategy on its own. The strategy is fixing known flaws fast, isolating compromised infrastructure quickly, and telling customers plainly what happened and what to do next. GMO is now doing the hard part in public. Other providers should learn from it before they have to do the same.