‘Unplug Your PC by Noon’: Inside GMO’s Week-Long Fight With the Hackers Behind Its Desktop Cloud Breach

It is not often that a hosting provider asks customers to physically pull the plug on their own computers. That is what Japan’s GMO Internet Group did this week, as hackers who broke into its Onamae.com Desktop Cloud service counted down to a deadline.

We pieced together this account from BleepingComputer’s coverage of the shutdown request and The Hacker News’ report on GMO’s bounty.

The week, day by day

Tuesday, October 20

GMO Internet found that a third party had installed malicious programs on some customers’ servers in Desktop Cloud, a service that hosts Windows desktops in the cloud. Customers use those desktops for foreign exchange (FX) trading.

Wednesday, October 21

GMO shut down servers across the service. The attackers sent an extortion demand of about 8 billion yen (roughly $50 million), which GMO has refused to pay.

Thursday, October 22

Brokerage FXTF warned customers that their trading logins may have been stolen.

Saturday, October 24

GMO confirmed that customer information had been taken. Credentials for the MetaTrader 4 and 5 trading platforms may have been exposed. GMO says 26,739 servers were potentially affected, a number it says does not mean each one was confirmed to have been broken into.

Sunday, October 25

In a blog post, GMO chief Masatoshi Kumagai wrote that the company’s own white-hat hackers had warned the team running the service about problems in advance, and that the response had been neither fast nor thorough enough.

Monday, October 26, and Tuesday, October 27

GMO warned that the attackers planned to leak data and set off ransomware they claimed to have planted. It asked customers to disconnect their PCs from the internet, shut them down and unplug them before noon Japan time on October 27, the hackers’ deadline. The attackers then posted material they said was information about GMO and its customers, and GMO later confirmed that company and customer data had been published. As of 1:55 p.m. that day, GMO said it had not confirmed any ransomware activity. PCs it had analyzed showed no malware so far.

Wednesday, October 28

The attackers’ site, including its mirrors, was shut down at about 4 a.m. Japan time, and GMO said it would act against any new site. GMO said the attackers’ site had also collected information about anyone who visited it. The same day, GMO opened the GMO Cybercrime Bounty, which pays up to $1 million for information leading to the attackers’ arrest or an international wanted notice.

Confirmed vs. claimed

Confirmed: Data was stolen and published. OANDA Japan confirmed that someone placed trades using customer logins believed to have leaked. GMO is working with Trend Micro on the investigation.
Claimed by the attackers, not confirmed: that one admin account was shared across all the servers, and that customers’ PC drives were visible from the cloud servers by default. They also threatened accounts at more than 70 securities and FX firms.
Unknown: how the attackers got in. GMO has not said.

What GMO is offering customers

5,000 yen for each affected user, plus coverage of losses from unauthorized trades.
Between 10,000 and 25,000 yen for each type of personal information published.
Replacement PCs for anyone whose computer is damaged by ransomware.
No restart of the breached systems. Instead, customers can move to a separate service free for six months, with details due by October 30.

GMO is also telling customers to change trading passwords from a device not used for trading, end active sessions, review trade history, turn on two-factor authentication, change any reused or browser-saved passwords, run antivirus scans and back up their data. It warns customers to ignore messages from the attackers and anyone offering to recover funds for a fee. Bounty emails will come only from the @cybercrimebounty.gmo domain.

What this means for your company

Many small businesses rent cloud desktops or remote servers and connect to them from office PCs, often with local drives shared through the connection for convenience. If the provider is breached, that connection can become a path back into your own machines. Turn off drive and clipboard sharing to remote sessions unless you truly need it, use unique passwords and two-factor sign-in for every financial and trading account, and keep offline backups so that “shut it down and unplug it” is something you can survive. Also ask your providers how they would warn you, and how fast, if something like this happened to them.

Want a second opinion on how your remote desktops and cloud servers connect back to your office? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.