A virtual desktop service provider in Japan has told customers to disconnect their machines from the internet after being breached by hackers.
GMO Internet’s Onamae.com service is delivered via a network of tens of thousands of servers operated by the firm and is popular with foreign-exchange traders.
However, the firm was forced to suspend the service on October 21 after discovering the day before that “malicious programs” had been installed in “some customers’ server environments.”
A security alert claimed that some information may have been accessed and that as many as 26,739 servers may have been impacted. Some reports suggest the hackers may have accessed trading accounts and made unauthorized transactions.
An extortion email sent on October 21 demanded a ransom of around eight billion yen ($50.7m).
Read more on ransomware attacks in Japan: Japanese Railway Operators Hit with Weekend Cyber Attacks
Having refused to pay the ransom, GMO Internet was notified by its attackers that they would deploy ransomware on October 27 as 12pm. As a result, it advised its customers to perform a full virus scan on their devices, back up all data, and then disconnect their PC from the internet and turn off the power.
In the meantime, GMO Internet has been asking for customers to ship their PCs so that its security team can investigate.
“As of [October 27, 11:59], no malware (including ransomware) has been detected in the devices that have been analyzed,” it explained.
“However, the analysis is still ongoing, and we have not yet confirmed the security of all customer devices. More devices from customers are expected to arrive in the future. We will proceed with the analysis as soon as they arrive.”
Japan Inc Under Fire
“This demonstrates how a vulnerability in a remote access service can have consequences far beyond the compromised system,” said Suzu Labs chief security evangelist, Phillip Wylie.ㅤ
"Attackers don’t necessarily need to deploy ransomware to cause significant damage. If they can steal sensitive information, compromise accounts, and threaten to publicly release data, they already have multiple ways to pressure an organization.”
Wylie added: "The biggest takeaway is that preventing the initial compromise is important, but limiting what attackers can do once they gain access is equally critical.”
The breach is the latest in a string of security incidents impacting Japanese firms this year. Organizations as diverse as Burger King (11 million customers), car rental company Times Car (6.6 million), karaoke giant Daiichi Kosho (eight million), and restaurant chain Yakiniku King (11 million) have suffered major data breaches.