GMO Internet Group says 26,739 servers are "potentially affected" by malicious programs found on its Onamae.com Desktop Cloud — and it has opened a public reward program offering up to $1 million for tips that lead to an arrest or an international wanted notice.
The attack and timeline
GMO Internet Group discovered that a third party had installed malicious programs on some Desktop Cloud customer servers on October 20 and shut down servers on every plan from October 21. The company confirmed unauthorized access and the exfiltration of customer information on October 24. Customers reported unrecognized trades beginning October 21.
GMO counts 26,739 servers as potentially affected; that figure is not a count of confirmed break-ins or confirmed data thefts. GMO said it had not yet confirmed how many customers its planned payments will cover, how much information was published, or which trades qualify for compensation, as of an October 28 stock exchange filing.
GMO Cybercrime Bounty: mechanics, limits and safeguards
The reward program, branded GMO Cybercrime Bounty, opened on October 28 and pays only if a tip helps lead to an arrest — including arrests outside Japan — or to an international wanted notice such as an Interpol Red Notice. The program will run until an arrest, an international wanted notice, or October 27, 2027, whichever comes first.
Tips may be submitted in Japanese, English or Chinese by email to an address listed on a dedicated website; they can be anonymous. GMO will decide how much each tip contributed: a single tipster can receive the full $1 million or the total may be split. Tipsters must prove their identity before payment. GMO says some people cannot be paid, including anyone involved in the crime, anyone who obtained information illegally (for example, by buying leaked data), and GMO staff.
GMO instructs tipsters not to break into systems, negotiate with or pay the attackers, or send leaked data, credentials, or malware. It says it will never ask for passwords, authentication codes or fees and that it writes to tipsters only from addresses ending in @cybercrimebounty.gmo. GMO will share tips with police and other authorities in Japan and abroad as needed, and has already given police its evidence on the threats, including communication records.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildImpact on FX trading accounts and broker responses
Desktop Cloud hosts Windows desktops used for FX trading; anything customers stored on the servers may have been viewed, including login credentials saved in trading software such as MetaTrader 4 and 5 (MT4/MT5), GMO said. Customers began reporting unknown trades on October 21.
OANDA Japan confirmed that a third party logged in to and traded on some of its customers' accounts using ID and password pairs it believes were leaked from the GMO servers. OANDA said it has restricted trading on accounts that may be affected and, as of October 26, had not found a break-in or leak in its own core systems.
FXTF warned on October 22 that third parties may have stolen logins of some customers who use VPS servers and said that attackers may have used those logins to trade. FXTF advised customers who had connected to Desktop Cloud to change their FXTF passwords from a device that had never connected to the Desktop Cloud.
GMO has said it will pay every current user ¥5,000 and will cover actual trading losses and fees from trades it confirms were unauthorized and caused by the breach. Customers whose information GMO confirms was published will receive ¥10,000 to ¥25,000 for each type of information exposed. GMO will not restart the service on the breached systems as they are; customers who want a Windows desktop will be offered a move to a separate service, free for six months and only with their consent, with details due by October 30.
Attackers' threats, published material, and claimed techniques
GMO said it received a demand for about ¥8 billion (about $50 million) on October 21 from people it believes carried out the attack; the attackers also threatened customers' trading accounts and data. They threatened to keep manipulating accounts at more than 70 securities and FX firms, to publish information about the service and customers' PCs, to hit those PCs with ransomware, and to publish details of GMO's systems.
The attackers set noon on October 27 for publishing customer information and launching a ransomware attack; no ransomware attack had been confirmed as of 1:55 p.m. Japan time on October 27. On October 27 the attackers posted material on their website that they said was information about GMO and its customers; ITmedia NEWS reported that the material was what the attackers called one customer's personal information. GMO said the site and its mirror domains were shut down at about 4 a.m. Japan time on October 28 and that it would act against any new site.
The attackers claimed on their website that one administrator account was shared across all servers and that customers' PC drives were visible from the servers by default when they connected, and that they used a flaw in the service to reach customers' own PCs; GMO had not publicly confirmed those claims as of October 28. GMO collected customer PCs for analysis and, as of 11:59 a.m. Japan time on October 27, had found no malware on the PCs it had finished checking, while analysis remained ongoing. GMO also said the attackers collected information about anyone who visited their site and advised visitors to run full antivirus scans.
What this means for technologists, FX brokers, and law enforcement
- Technologists and security teams: will watch GMO’s forensic results and the company’s analysis of how administrative access and server default visibility may have been used, and will track whether the collected PCs reveal evidence of lateral movement or client-side compromise.
- FX brokers and affected traders: are already taking account-level steps — OANDA Japan restricted trading on suspect accounts and FXTF advised password changes from unaffected devices — and will need GMO’s confirmation process to identify losses that the company will cover.
- Law enforcement and cross-border investigators: will be the gatekeepers for reward payments, because GMO will pay only after an arrest or an international wanted notice; GMO has shared its evidence with police in Japan and abroad and is pushing tips to authorities through the bounty process.
GMO has tied financial incentives to law enforcement outcomes rather than to private negotiation with the attackers: tips earn money only if they help secure an arrest or an international wanted notice. The immediate practical steps for customers are concrete — password resets from uncompromised devices, session termination through brokers, antivirus scans and two‑factor authentication where available — while the larger questions the record leaves open are operational and legal: how the attackers gained access, the full extent of published material, and whether the bounty will surface actionable intelligence that leads to an arrest.
