Japanese Hosting Firm GMO Warns Clients to Power Down Systems Amid Imminent Ransomware Threat

Tokyo‑based GMO Group, a major provider of domain registration and cloud services in Japan, issued an urgent advisory on Tuesday urging its customers to disconnect from the internet and shut down their computers. The warning follows a breach of the company’s Onamae Desktop Cloud platform, after which a threat actor claimed it would unleash a ransomware attack later that day.

The compromised Onamae Desktop Cloud service hosts a range of small‑ to medium‑size business websites and internal applications. According to GMO, the intrusion was detected early on Tuesday, and the attacker subsequently demanded that the firm refrain from taking remedial action unless a ransom was paid. When the demand was not met, the group threatened to encrypt data on affected systems within hours.

In response, GMO’s security team recommended that all clients immediately isolate any machines connected to the compromised cloud environment, disable remote access, and power down devices that are not essential for business continuity. The company also instructed customers to back up critical data offline and to monitor for any suspicious activity on their networks.

Cyber‑security experts note that such pre‑emptive shutdowns are a standard containment measure when a ransomware actor signals an imminent strike. By cutting off network connectivity, organizations can limit the spread of encryption malware, which often propagates laterally across connected systems. The timing of the threat—specifying “today” as the attack window—suggests the actor was attempting to create pressure and panic, a tactic seen in recent ransomware campaigns worldwide.

Japan’s cyber‑defense landscape has been on high alert following a series of high‑profile ransomware incidents targeting both public and private sectors. The government’s Cybersecurity Strategy Office has repeatedly urged firms to adopt robust backup practices and incident‑response plans. GMO’s public advisory aligns with these national recommendations, highlighting the growing need for rapid, coordinated action when a breach is discovered.

While GMO has not disclosed the identity of the threat actor or the extent of the data potentially exposed, the company said it is working with law‑enforcement agencies and third‑party security consultants to investigate the breach. Customers are advised to await further updates from GMO, which promises to provide detailed guidance on restoring services once the immediate threat has passed. The incident underscores the persistent risk posed by ransomware groups and the importance of vigilance in the cloud‑dependent business environment.