Hackers steal and leak private GMO data after Japanese firm refuses $50 million ransom

The deadline has passed, and attackers who hacked the Japanese internet conglomerate, GMO Internet Group, on October 21 have published information they claim to belong to the group and its customers. The leak of this seemingly confidential data comes after GMO refused to pay a $50 million ransom to the hackers. GMO says it is verifying the leaked material to check for legitimacy urging customers to refrain from accessing, sharing, and by extension, causing any potential panic.Notably, the incident has once again put the spotlight on the growing threat of cyberattacks in Japan and prompted GMO CEO Masatoshi Kumagai to warn that the internet itself is on the verge of collapse.How the GMO cyberattack unfoldedThe incident began earlier this month when attackers gained unauthorised access to GMO’s Onamae.com Desktop Cloud service, which is used by businesses, including those involved in financial trading.GMO suspended the service on October 21 and received a ransom demand of around 8 billion yen, or approximately Rs 482.2642 crore, according to the company. It later reported that the breach could have affected 26,739 servers. The consequences extended beyond stolen data. Unauthorised trades were carried out through accounts linked to more than 70 securities firms, foreign exchange providers and other businesses. Japan’s finance minister said five foreign exchange margin-trading services connected to GMO had been affected, with some customers reporting financial losses.GMO has promised to compensate customers for losses caused by unauthorised transactions. It has also announced a flat payment of 5,000 yen (roughly Rs 3,014) to all customers as a goodwill gesture.Why GMO refused to pay the ransom In its latest update, the company explained its decision, saying, “We will not comply with the attackers’ demands. This is because complying with their demands does not guarantee that the information they obtained will be deleted or that its unauthorised use will be prevented.”GMO said it had consulted the police and other relevant authorities and was working with them on the investigation. It has also begun examining customers’ computers to determine whether malware, including ransomware, was installed. Security firms, including Trend Micro, and other technology companies have offered assistance.The company has urged customers to back up their data, run antivirus scans, disconnect their computers from the internet, shut them down and unplug them.CEO warns of a wider internet crisisIn a blog post, Kumagai described the incident as part of a broader cybersecurity crisis. “The internet itself is now starting to break down,” due to misuse of AI, and frames this event as a national crisis.The warning comes as cyberattacks become more frequent and potentially easier to carry out with AI tools. Reuters reported that Japan recorded 723 cybersecurity incidents in the year to October 20, according to TrendAI data, already exceeding the annual totals for 2024 and 2025.- Ends