All incidents

GMO Internet Group's Onamae.com Desktop Cloud rents Windows desktops hosted on GMO servers and is commonly used to run automated currency-trading tools. GMO detected an intrusion on October 20 and said malware could have been installed on up to 26,739 customers' servers. It began shutting down all plans on October 21, and on October 28 it said it will not restart the platform in its current form. Customers reported unrecognized activity on foreign-exchange trading accounts, and five trading firms told Japan's Financial Services Agency that their customers were affected. On October 26 GMO said the attacker planned to publish customer information and trigger ransomware at noon on October 27, and it told customers to back up, disconnect and power down their PCs. By that afternoon GMO had confirmed no ransomware, and purported customer data later appeared online. GMO reportedly refused a ransom demand and had the publishing domain taken down on October 28, though replacement sites could appear. GMO also reported a $50 million demand on October 21, launched a bounty of up to $1 million for information leading to the attackers, offered affected customers a free replacement desktop service for six months, and announced compensation that includes 5,000 yen for every current customer and reimbursement of confirmed losses from unauthorized trades. In its latest report it said it had found no sign of malware or ransomware on the customer devices analyzed so far. The attacker has not been identified.