INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

GMO Offers $1 Million Bounty to Catch Hackers Behind Breach

| 2026-10-28 07:13 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 28, Japan's GMO Internet Group shut down its Onamae.com Desktop Cloud service after a breach, affecting an estimated 26,739 servers. The attackers, believed to be behind the $50 million extortion demand made on October 21, have also threatened customers' trading accounts and data. To catch the hackers, GMO is offering up to $1 million in total for tips that lead to an arrest or international wanted notice. Tips must provide information linking people, servers, domains, IP addresses, accounts, or cryptocurrency addresses to the attack, extortion, or money movement, along with evidence of how the crimes were carried out. The reward program opened on October 28 and will remain open until an arrest, international wanted notice, or October 27, 2027, whichever comes first; tips sent after this date may not be eligible for payment.
Technical Mitigations AI-generated
• Patch MetaTrader 4 and 5 (MT4/MT5) to prevent unauthorized access, as customers' login credentials were saved in the trading software. • Monitor for suspicious activity on VPS servers, as a third party may have stolen logins of some customers who use these services. • Use two-factor authentication or IP blocking techniques to restrict trading on accounts that may be affected by the breach.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA financefinance
Incident Timeline
‎October 20
GMO Internet discovered malicious programs installed on some customers' servers by a third party on October 20.
‎October 21
Japan's GMO offered a $1 million bounty to catch hackers behind the FX trading cloud breach, which began with customers reporting unrecognized trades on October 21.
‎October 22
FXTF warned on October 22 that third parties may have stolen the logins of some customers who use VPS servers in an attack it believes hit another company's VPS servers.
organisation FXTF
Another broker, FXTF, warned on October 22 that third parties may have stolen the logins of some customers who use VPS servers, in an attack it believes hit another company's VPS servers.
organisation VPS
Another broker, FXTF, warned on October 22 that third parties may have stolen the logins of some customers who use VPS servers, in an attack it believes hit another company's VPS servers.
‎October 24
Threat actors used unknown methods to target GMO's FX trading cloud service, resulting in unauthorized access and the exfiltration of customer information.
tactic Exfiltration
On October 24, GMO said it had confirmed a security problem in the service's systems, unauthorized access to the service, and the exfiltration of customer information from the company.
‎October 25
GMO Internet Group's white-hat hackers warned the team running its FX trading cloud service about potential issues in advance.
‎October 26
GMO Japan collected PCs from customers for analysis as of October 26, following a suspected FX trading cloud breach.
‎October 27
Threat actors posted material on their website claiming to be information about GMO and its customers, setting a deadline for publishing customer data.
target_region Japan
Japan time on October 27, it had found no malware, including ransomware , on the PCs it had finished checking.
tactic Ransomware
Japan time on October 27, it had found no malware, including ransomware , on the PCs it had finished checking.
They set noon on October 27 for publishing customer information and launching the ransomware attack.
‎October 28
The site's domain, including its mirror sites, was shut down at about 4 a.m. Japan time on October 28.
source_region Japan
The site's domain, including its mirror sites, was shut down at about 4 a.m. Japan time on October 28, and GMO plans to act against any new site.
general_metric 4 a.m.
The site's domain, including its mirror sites, was shut down at about 4 a.m. Japan time on October 28, and GMO plans to act against any new site.
‎2026/10/28
GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service.
organisation GMO Offers
Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach.
financial $1 Bounty
Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach.
Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand.
organisation GMO Internet Group
Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand.
organisation Onamae.com Desktop Cloud
Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand.
infrastructure Windows
The service hosts Windows desktops used for FX trading, and a broker has linked unauthorized trades on some of its customers' accounts to logins leaked from the service.
organisation FX
The service hosts Windows desktops used for FX trading, and a broker has linked unauthorized trades on some of its customers' accounts to logins leaked from the service.
organisation GMO
GMO says the attackers took customer information.
organisation GMO Cybercrime Bounty
How the Reward Works GMO Internet Group runs and pays for the program, called GMO Cybercrime Bounty .
‎October 30
Windows will offer customers a free six-month transition to a separate service for Windows desktop users by October 30.
infrastructure Windows
Customers who want a Windows desktop will be offered a move to a separate service, free for six months and only with their consent, with details due by October 30.
‎October 27, 2027
Threat actors breached GMO Internet's FX trading cloud, exposing customer data and threatening to manipulate accounts at multiple securities firms.
industry Finance
General Document Context
organisation Tips
Tips are shared with police and other authorities in Japan and abroad as needed.
organisation OANDA Japan
A broker, OANDA Japan , has confirmed that a third party logged in to and traded on some of its customers' accounts using ID and password pairs it believes were leaked from the GMO servers.
financial $1 Bounty
GMO decides how much each tip helped, and one tipster can receive the full $1 million or the total can be split.
organisation IP
GMO wants information linking people, servers, domains, IP addresses, accounts, or cryptocurrency addresses to the attack, extortion, or movement of money, along with evidence of how the crimes were carried out.
organisation Interpol Red Notice
A tip earns money only if it leads to an arrest, including one by police outside Japan, or to an international wanted notice, such as an Interpol Red Notice.
organisation Desktop Cloud
What Customers Should Do GMO has told Desktop Cloud customers to take these steps :
infrastructure 26,739 servers
It counts 26,739 servers as potentially affected , which is not the number of confirmed break-ins or data thefts.
victims 5,000 current user
GMO Internet will pay every current user ¥5,000 and cover actual trading losses and fees from trades it confirms were unauthorized and caused by the breach.
financial 25,000 information
Customers whose information it confirms was published will also get ¥10,000 to ¥25,000 for each type of information exposed.
Tactical Metrics
Metrics
financial
1,000,000
Bounty
Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach.
Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand.
GMO decides how much each tip helped, and one tipster can receive the full $1 million or the total can be split.
Metrics
infrastructure
‎Windows
Affected Product
The service hosts Windows desktops used for FX trading, and a broker has linked unauthorized trades on some of its customers' accounts to logins leaked from the service.
Customers who want a Windows desktop will be offered a move to a separate service, free for six months and only with their consent, with details due by October 30.
Metrics
infrastructure
26,739
Servers
It counts 26,739 servers as potentially affected , which is not the number of confirmed break-ins or data thefts.
Metrics
victims
5,000
Current User
GMO Internet will pay every current user ¥5,000 and cover actual trading losses and fees from trades it confirms were unauthorized and caused by the breach.
Metrics
financial
25,000
Financial Impact / Stolen Funds
Customers whose information it confirms was published will also get ¥10,000 to ¥25,000 for each type of information exposed.
Intelligence Sources
The Hacker News 2026-10-28