1. Publication of Information by Persons Believed to Be the Attackers and the Ransomware Attack

① Regarding the Publication of Information

At 12:30 on October 27, we confirmed that persons believed to be the attackers had published what they claim to be information about our company and our customers. We are currently verifying the published content. It may contain information that is inconsistent with the facts.

We ask our customers to note the following points.


[Important] [Danger] Please do not access or spread what is claimed to be the published information.
The information of those who have accessed the site in question has been obtained by the attackers. We cannot accept responsibility for any damage arising from access to the site, so please refrain from accessing it.

[Important] From the perspective of preventing secondary damage, we are preparing legal measures, including requests for disclosure in civil proceedings and criminal complaints and accusations, against those who spread information with a high degree of malice, after preserving evidence. We intend to respond resolutely in order to protect our customers.

If we confirm that the published information contains customer information, we will contact the customers concerned individually.

② Regarding the Ransomware Attack
As of 13:55 on October 27, no ransomware attack has been confirmed. We remain on alert.

・Please beware of emails, SMS messages, and phone calls that take advantage of this incident by impersonating our company or related organizations.

2. Sympathy Payments to Customers Whose Information Has Been Published

For customers whose information we confirm is included in the published information, we have begun deliberations at an emergency meeting, separately from the sympathy payment (a flat 5,000 yen) announced in the Fourth Report.

Click here for the Fourth Report:
https://internet.gmo/en/news/article/249/

3. Analysis of Customers’ Devices Is Continuing

When we asked for your cooperation in the investigation on October 25, we received responses from customers across Japan. Our partners (employees) have visited customers nationwide and taken custody of their devices. We sincerely thank the customers who have cooperated.

The devices we have received are being investigated and analyzed in turn by the white-hat hacker team of the GMO Internet Group. We are continuing the analysis with the aim of confirming the extent of the damage, including whether malware (including ransomware) has actually been planted, and finding a way to deal with it.

Devices provided by customers who have cooperated with us are still expected to arrive. We will proceed with the analysis as soon as they arrive.

4. Offers of Cooperation from Private Companies

In responding to this matter, we have received offers of cooperation from security companies such as Trend Micro Incorporated, as well as from AI companies and others. In order to make use of each company’s specialized expertise in our investigation and response, we are confirming and coordinating the specific details of their cooperation.

Our Group is grateful for these offers of cooperation and will continue its efforts in responding to customers and in investigation and analysis.

5. We Will Inform You Immediately If New Facts or Countermeasures Are Identified

If the investigation reveals new facts, or measures that customers should take, we will contact customers who use the Service individually by email and will also announce them on this page.

■ Requests to Customers

1. Please run a full antivirus scan on your own devices

2. Please back up your data

3. Please disconnect your PC from the network and power it off

Please back up your data, disconnect from the network, shut down the power, and unplug the cords connected to your PC.

4. Actions to protect your account

Caution: We will never ask you for your password or authentication code. Please do not respond to any communication that asks for payment, such as an offer to “recover your losses.” Announcements from us can also be checked on this page. Please do not open links or files in emails or SMS messages; check this page instead.

For details, click here:
https://internet.gmo/en/news/article/252/

■ Request to the Media

As you are already aware, it has been confirmed that information believed to relate to our customers has been published by the attackers.
We kindly ask the media to refrain from excessive reporting that could cause secondary damage to our customers.

■ Our Policy

We will not comply with the attackers’ demands. This is because complying with their demands does not guarantee that the information they obtained will be deleted or that its unauthorized use will be prevented. We have consulted the police and other relevant authorities on this matter and are proceeding with our response in cooperation with them.

■ Timeline to Date

・October 21 (Wed): Suspended the Service and published the first report on the unauthorized access (4:00) / Received a threatening email (demanding approximately 8 billion yen)
・October 22 (Thu) 13:00: Consulted the police
・October 22 (Thu) 16:59: [Important] Notice and Apology Regarding Unauthorized Access to “Onamae.com Desktop Cloud” (Second Report)
・October 24 (Sat) 11:50: Regarding Payment of Sympathy Payments to Customers and Compensation for Losses from Unauthorized Transactions ~ Began Requesting Relevant Government Agencies to Implement Measures Related to Active Cyber Defense ~ (Fourth Report)
・October 24 (Sat) 15:00: Decided on the payment of sympathy payments, compensation for losses, and the provision of alternative services (11:50 / Fourth Report)
・October 24 (Sat) 15:00: Requested that relevant government agencies apply Active Cyber Defense; Request for security measures (Fifth Report)
・October 25 (Sun): Asked customers to cooperate with the device investigation
・October 26 (Mon) 21:00: Reiterated our requests to customers (Sixth Report). Began analyzing the devices we took custody of (Seventh Report)
・October 27 (Tue) 9:58: Announced the interim progress of the device analysis and the offers of cooperation from private companies, and asked customers to power off their PCs in preparation for the announcement for 12:00 (Eighth Report)
・October 27 (Tue) 11:59: Announced the status of the device analysis and our renewed requests (Ninth Report)
・October 27 (Tue) 13:55: Announced the publication of information by the attackers (Tenth Report)

■ Contact for Inquiries (Accepted 24 Hours a Day)

・Contact form: https://help.onamae.com/contact/
・Phone: +81-3-5456-2560 (open 24 hours, including weekends and public holidays)

■ Previous Announcements

Report 1: https://www.onamae.com/news/article/11584
Report 2: https://internet.gmo/en/news/article/247/
Report 3: https://internet.gmo/en/news/article/248/
Report 4: https://internet.gmo/en/news/article/249/
Report 5: https://internet.gmo/en/news/article/250/
Report 6: https://internet.gmo/en/news/article/252/
Report 7: https://internet.gmo/en/news/article/253/
Report 8: https://internet.gmo/en/news/article/254/
Report 9: https://internet.gmo/en/news/article/255/