Page traduite et vérifiée automatiquement. La version anglaise fait foi.Certaines parties restent en anglais le temps que leur traduction soit vérifiée.Voir en anglais · Signaler une erreur de traduction
BREACH WATCH BRIEFÉlevé💀 Rançongiciel
Japan’s GMO Group Offers $1 M Bounty After Hackers Compromise 26,739 VPS Customers and Demand ¥8 Billion Ransom
GMO Group’s cloud‑hosting platform was breached, exposing over 26,000 virtual servers, stealing trading credentials, and prompting an ¥8 billion extortion demand. The incident highlights the need for robust access controls and continuous monitoring to satisfy audit‑readiness across frameworks.
Breach Watch ADTP· October 28, 2026· DataBreachToday
On 21 Oct 2026 GMO Group detected unauthorized access to its Onamae.com Desktop Cloud service, a VPS offering used for automated FX trading. Attackers breached up to 26,739 virtual servers, installed malware on users’ remote‑desktop PCs, stole MetaTrader 4/5 credentials, and performed unauthorized trades. A ransom note demanded ¥8 billion (≈ US $50 M); three days later the demand was reduced to US $1 M with a short deadline. GMO refused to pay and announced a US $1 M bounty for information leading to the perpetrators’ identification, launching a public tip‑line that received over 100 leads within the first day.
Pourquoi c’est important pour la confiance et la conformité
The breach demonstrates why strong identity‑and‑access controls and continuous monitoring of privileged cloud accounts are essential for audit‑ready control assurance.
Validate that privileged‑access policies enforce MFA and least‑privilege principles.
Implement continuous log‑analysis to provide defensible evidence of anomalous remote‑desktop activity.
Who is affected
Cloud hosting providersFinancial‑trading SaaS platformsEnterprises offering remote‑desktop or VPS services
Recommended actions
Review and tighten privileged‑access policies for all cloud‑hosted VMs.
Enforce multi‑factor authentication for administrative accounts.
Deploy continuous monitoring and alerting on remote‑desktop and SSH sessions.
Update incident‑response playbooks to include credential‑theft and extortion scenarios.
Bibliothèque des réglementations
Toutes les lois des États américains sur la vie privée, sur une seule carte
24 États disposent d’une loi générale sur la vie privée dans la bibliothèque, aux côtés des lois de l’UE, du Royaume-Uni, des lois fédérales américaines et des lois du reste du monde : 102 au total, chacune expliquée en termes simples avec ses sources. Sélectionnez un État pour voir ce qui s’y applique.