GMO Puts a $1 Million Bounty on the Attackers Behind Its FX Trading Cloud Breach

Japan's GMO Internet Group has turned down an eight-figure extortion demand and is instead offering up to 1 million US dollars to anyone whose information leads to the arrest of the people who broke into its Onamae.com Desktop Cloud service. The reward programme opened on 28 October 2026 and runs for a year, or until an arrest or an international wanted notice closes the case.

What happened

Onamae.com Desktop Cloud rents hosted Windows desktops, used mainly by retail forex traders to keep platforms such as MetaTrader 4 and 5 running around the clock. On 20 October, GMO Internet, the subsidiary that operates the service, discovered that an outside party had planted malicious programs on some customers' virtual servers. It took every server on every plan offline from 21 October and currently counts 26,739 servers as potentially affected. That figure is the whole fleet, not a count of confirmed intrusions.

By 24 October the company had confirmed three things: a security flaw in the service, unauthorised access to it, and the exfiltration of customer information. Anything a customer had saved on their hosted desktop may have been read, including broker logins stored inside trading software. Payment card data was never kept on those servers.

The consequences showed up quickly at the brokers. From 21 October, traders began reporting trades they had not placed. One Japanese broker has confirmed that a third party logged into some customer accounts with credentials it believes came from the GMO servers and executed trades, and it has restricted trading on accounts that might be affected. A second broker warned its customers on 22 October that their logins may have been stolen the same way and asked them to reset passwords from a device that had never touched the hosted desktop.

The extortion attempt

On 21 October the company received a demand of roughly 50 million US dollars, around 8 billion yen, from a group it believes carried out the intrusion. The attackers threatened to keep manipulating accounts at more than 70 securities and FX firms, publish data about the service and its customers, push ransomware to customers' PCs and expose details of GMO's internal systems.

GMO refused. The group set noon on 27 October as its deadline. No ransomware wave was confirmed that day, and the material that did appear on the group's leak site was described as a single customer's personal information. The site and its mirrors went dark at around 4 a.m. Japan time on 28 October, and GMO says it will go after any replacement. It has also warned that the leak site collected data on everyone who visited it, and asked people not to visit, link to or repost anything from it.

How the attackers got in

GMO has not yet said how the intrusion started. The group's chairman wrote on 25 October that its own white-hat team had flagged problems with the service in advance, and that the response was neither fast nor thorough enough. The attackers, for their part, claim that a single administrator account was shared across every server and that customers' local PC drives were exposed to the hosted desktops by default. They also claim they used a flaw in the service to reach customers' own computers. None of these claims has been publicly confirmed by GMO.

Customer PCs handed over for analysis had shown no malware, ransomware included, as of the morning of 27 October. GMO is careful to note that this does not mean every device is clean, and the forensic work continues.

How the bounty works

The programme, called GMO Cybercrime Bounty, accepts tips by email in Japanese, English or Chinese, anonymously if the tipster prefers. GMO is looking for evidence that ties specific people, servers, domains, IP addresses, accounts or cryptocurrency wallets to the intrusion, the extortion or the movement of money. Speculation, unsupported accusations and reposts of public material do not count.

Payment is made only if a tip contributes to an arrest, including by police outside Japan, or to an international wanted notice such as an Interpol Red Notice. GMO decides how much each tip contributed, so one person can take the full amount or the pot can be split. Tipsters must verify their identity before being paid. Anyone involved in the crime, anyone who obtained information illegally, for example by buying leaked data, and GMO employees are excluded. The company explicitly tells tipsters not to hack anyone, not to negotiate with or pay the attackers, and not to send it leaked data, credentials or malware. Tips are passed to law enforcement in Japan and abroad.

GMO adds that it will never ask tipsters for passwords, one-time codes or fees, and that it writes only from its dedicated bounty email domain. Expect impersonators to test that.

What affected customers should do

• Change trading-account and trading-platform passwords from a device never used for trading, such as a phone.
• Terminate every active session, through the broker if necessary, even after a password change.
• Review trading history and balances, and report unknown trades to the broker first.
• Enable two-factor authentication wherever the broker supports it.
• Rotate any password that was reused elsewhere or saved in a browser on the hosted desktop.
• Run a full antivirus scan on every device that connected to the service, and back up data.
• Ignore messages from anyone claiming to be the attackers, and do not open their links or attachments.
• Treat any offer to recover lost funds for a fee as a scam.

GMO Internet will pay every current user 5,000 yen, cover actual losses and fees from trades it confirms were unauthorised and caused by the breach, and pay 10,000 to 25,000 yen per category of personal data it confirms was published. It will not bring the breached systems back as they are. Customers who still need a hosted Windows desktop will be offered a move to a separate service, free for six months and only with their consent, with details promised by 30 October. The company has said it cannot yet confirm how many customers its compensation will cover, how much data was published, or which trades qualify.

Why it matters

This incident is a reminder that a hosted desktop is only as safe as the platform it runs on. A trader can do everything right at the broker and still lose control of an account because credentials sat in a configuration file on someone else's server. For the brokers, the attack arrived as valid logins from legitimate-looking sessions, which is why the first signal came from customers noticing trades they never made.

Stolen credential sets like these rarely stay with the original thieves. They get sold, traded and reused long after the headlines fade. Our Deep/Dark Web monitoring service tracks criminal forums and leak sites for exactly this kind of data, so an organisation learns that its users' or employees' logins are circulating before someone else puts them to use.