What happened. GMO says it detected the intrusion on Oct 20 and that malware could have been installed on up to 26,739 customer servers. It shut the servers down and cut service while it investigated. Payment details were not exposed, per GMO, but MetaTrader 4 and 5 trading credentials and account details may have been, so customers were told to reset passwords and end active sessions. A VPS (virtual private server) is a rented cloud machine, and in this case many customers used them to run trading platforms.
How it escalated. The attacker demanded ¥8 billion (about $50M), and GMO said no and offered every customer ¥5,000 (about $30). On Oct 26 GMO warned the attacker planned to leak customer data and fire the ransomware already sitting on customer servers. GMO is working with Trend Micro, scanning customer systems for leftover malware, and has offered replacement PCs to anyone hit by ransomware. On Oct 27 it confirmed company and customer data had been published and said it may pay more to customers whose data was exposed. GMO Internet is one of Japan's largest domain registrars.
What I'd do today. If you or a supplier run anything on Onamae Desktop Cloud, treat those servers as compromised: rebuild from a known-good backup instead of cleaning in place, and rotate every credential that ever touched them, trading logins included. The wider lesson is about hosting providers: when the provider's own control plane is breached, the attacker can reach every tenant at once. Ask your VPS and managed-hosting vendors how quickly they could detect and contain that, and keep offline backups they can't touch.