GMO Puts $1 Million on the Table to Catch Hackers Who Raided Its FX Cloud Service

Japanese tech conglomerate GMO Internet Group has launched a bounty programme offering up to $1 million for information that leads to the arrest of whoever broke into its Onamae.com Desktop Cloud service. The company declined to pay the attackers' $50 million extortion demand, so now it's trying the crowdsourced route instead.

The programme, which opened on 28 October and runs until an arrest is made or October 2027, pays out only on results. A tip needs to actually get someone arrested, or at minimum generate an Interpol Red Notice, before any money changes hands. GMO decides unilaterally how much each tip contributed, so the full million could go to one person or get carved up between several. Anonymous tips are accepted, but anyone wanting payment has to prove who they are first.

The rules exclude the obvious candidates: anyone involved in the attack, anyone who obtained information through dodgy means, and GMO's own staff. The company is also telling would-be tipsters not to hack anything, pay the attackers, or forward stolen data. Tips are shared with police in Japan and internationally. GMO says it has already handed investigators everything it has.

So what actually happened? On 20 October, GMO discovered malicious software installed on customer servers within its Desktop Cloud service, which hosts Windows desktops primarily used for foreign exchange trading. The company pulled the plug on those servers the following day. Around 26,700 servers are considered potentially affected, though GMO has been careful to frame that as a ceiling rather than a confirmed count of compromised machines.

The exfiltration of customer data was confirmed on 24 October. Because customers stored trading software like MetaTrader 4 and 5 on these servers, any login credentials saved within those applications were fair game. Broker OANDA Japan has since confirmed that a third party used credentials believed to have come from GMO's servers to log into customer accounts and execute trades. Another broker, FXTF, issued similar warnings and told its customers to change passwords from a device that had never touched the Desktop Cloud service.

The attackers made contact on 21 October and demanded roughly 8 billion yen. They threatened to manipulate accounts across more than 70 financial firms, deploy ransomware on customers' PCs, and publish stolen data. They set a noon deadline on 27 October. That day they posted what they claimed was one customer's personal information. The ransomware attack had not been confirmed as of that afternoon. GMO subsequently got the attackers' site and its mirror domains taken down within hours.

How the attackers got in has not been officially confirmed. GMO's own group chief, Masatoshi Kumagai, admitted in a blog post that internal white-hat security teams had flagged vulnerabilities in the service beforehand, and that the response was too slow and incomplete. The attackers, for their part, claimed on their site that a single administrator account was shared across all servers, and that customer PC drives were visible from those servers by default. They also claimed to have pivoted from the cloud servers onto customers' own machines through a flaw in the service. GMO had not publicly confirmed any of those claims as of the time of writing, though it has been collecting customer PCs for forensic analysis.

For affected customers, GMO's advice is straightforward. Change trading account passwords from a clean device, log out of every active session, review trading history for anything suspicious, enable two-factor authentication wherever the broker supports it, and run antivirus scans on any machine that connected to the service. Do not engage with anyone claiming to be the attackers, and ignore anyone offering to recover lost funds for a fee.

On compensation, GMO will pay every current user 5,000 yen and cover verified losses from confirmed unauthorised trades. Customers whose data was published stand to receive between 10,000 and 25,000 yen per category of exposed information. The service itself will not be restarted on the compromised infrastructure. Affected customers will be offered migration to a separate service, free for six months, details pending.