GMO Internet said on October 28 that the domain used to publish alleged customer information following the GMO cloud breach had been suspended. Its latest update, issued at 11:00 JST, said the suspension occurred around 04:00 JST after coordination with service providers. The Japanese company is investigating an Onamae.com Desktop Cloud intrusion that potentially affected 26,739 servers.

According to GMO's initial notice, malicious programs were found in some customer server environments on October 20. The company began shutting down servers across all service plans on October 21. The 26,739 figure describes potentially affected servers, not confirmed infections or individual victims.

GMO confirmed in its October 24 report that the service had security vulnerabilities, unauthorized access had occurred and customer information had been taken outside the company. Some customers reported trading-account transactions they did not recognize. That notice did not identify a specific exploited vulnerability or explain how the malicious programs were installed.

BleepingComputer reported on October 27 that GMO had urged customers to back up data, disconnect their PCs and power them off ahead of a threatened ransomware attack. In its ninth report, GMO said devices examined by 11:59 JST that day had shown no malware, while stressing that analysis was incomplete. Its tenth report said no ransomware attack had been confirmed as of 13:55 JST.

GMO said suspected attackers published material on October 27 claiming to contain company and customer information, but verification was continuing. In its October 28 update, the company said it would monitor for replacement sites and seek their removal. It asked people to avoid accessing or redistributing the material and said concerned customers could contact its support team around the clock.

In its October 27 evening update, GMO reaffirmed that it would refuse the attackers' demands and announced a cybercrime information reward program capped at USD 1 million in total. It also outlined additional payments for customers whose information is confirmed in the published material, separate from earlier compensation measures.

GMO's customer guidance calls for changing credentials stored or used on affected servers, including passwords reused elsewhere. Its latest response policy warns against phishing messages and offers demanding payment to recover losses. Customers whose information is confirmed in the published material will be contacted individually, the company said.