GMO Internet CEO Reveals $50 Million Ransom Demand After Cloud Breach

GMO Internet Group CEO Masatoshi Kumagai disclosed Monday that a $50 million demand had been made in connection with the Onamae.com Desktop Cloud breach, a new detail in the extortion case.

Kumagai said GMO had made no payment. The demand document is dated 10:57 p.m. ET Oct. 20 (02:57 UTC Oct. 21). GMO's Oct. 24 update put the potentially affected total at 26,739 servers; that figure is not a count of confirmed intrusions. The company has confirmed customer information was taken, and some customers have reported trades they did not authorize. GMO has not provided a total loss figure.

After detecting malicious software in some customer server environments, GMO started the shutdown at 3 p.m. ET Oct. 20 (19:00 UTC). The service hosts foreign exchange trading tools, including MetaTrader 4 and MetaTrader 5. GMO said Monday that people it believes were involved threatened to publish customer information and launch ransomware attacks at 11 p.m. ET Monday (03:00 UTC Tuesday). Investigators are examining customer devices for malware, including ransomware.