-
GMO is providing rewards reaching $1 million for any credible information leading to the arrest of some computer hackers.
-
The hackers demanded $50 million after compromising the system that resulted in customer data leaks, and possibly activated unauthorized trades.
-
GMO plans to compensate customers, review reported losses and offer a separate cloud service free for six months.
Japan’s GMO Internet Group is offering up to $1 million for information that helps authorities catch hackers behind a major security breach. The attack targeted its Onamae.com Desktop Cloud service, which provides online computers for foreign exchange traders.
The attackers demanded $50 million, but GMO refused to pay. The incident exposed customer information and may have helped criminals access trading accounts and make unauthorized trades.
GMO Launches a $1 Million Reward Program
On October 28, 2026, GMO launched its GMO Cybercrime Bounty program. The company will offer rewards for valuable information that will lead to an arrest or an international wanted notice for attackers.
The program allows the submission of bounties in Japanese, English, and Chinese. Senders can remain anonymous when submitting valuable information, but they must be able to prove their identity at the time of payment. The program will last until an arrest, an international wanted notice, or till October 27, 2027.
GMO is expecting valuable information to help the investigators identify the criminals behind the robbery. Valuable information can include connection of the suspects to the servers, online accounts, websites, and crypto wallets. Information about the blackmailing attempt and the movement of the stolen money are also part of the deal.
Cybercrime investigations can also involve large-scale public reporting systems, as seen in the hack that exposed 1.5 million Canadian Crime Stoppers tips spanning 25 years.
However, guesses, unsupported accusations and simple reposts of public information will not qualify. GMO will decide how much each tip helped the investigation. One person may receive the full reward, or the company may split it among several people.
The company also warns tipsters against breaking into systems, paying the attackers, or sending stolen data. People involved in the crime and GMO employees cannot receive rewards. GMO says it will share useful information with law enforcement agencies.
Hackers Demanded $50 Million After Stealing Data
The attack targeted Onamae.com Desktop Cloud, which provides online Windows computers for customers, including foreign exchange traders. GMO discovered on October 20 that someone had installed harmful programs on some customer servers.
The company began shutting down servers across its service plans on October 21 – but it later confirmed unauthorized access and the theft of customer information. GMO identified 26,739 servers as potentially affected, but that number does not mean criminals entered every server.
On October 21, the attackers demanded about $50 million, or ¥8 billion. They threatened to publish company and customer information if GMO refused to pay. They also warned of further attacks involving customer trading accounts and ransomware.
Ransomware is harmful software that can lock files or systems and demand money. The attackers also threatened to expose details about GMO’s systems and customer computers.
GMO refused to pay because doing so could not guarantee the criminals would delete the stolen information. The company shared evidence, including records of its communications with the attackers, with the police.
Meanwhile, the attackers published material they claimed belonged to GMO and its customers on October 27. GMO began checking the files to establish what they contained. Authorities shut down the attackers’ website and mirror sites the following morning. However, this action does not prove the criminals deleted the stolen data.
Stolen Login Details May Have Enabled Unauthorized Trades
The breach raised concerns because customers may have stored trading passwords and other login details on the affected cloud computers. These details may have included credentials for MetaTrader 4 and MetaTrader 5 – two widely used trading platforms.
Some customers reported trades they did not recognize. OANDA Japan said criminals used login details believed to have leaked from GMO’s servers to access and trade on some customer accounts.
OANDA restricted trading on accounts that might have suffered harm. As of October 26, the broker had found no evidence that criminals had breached its own main systems. Other brokers also warned customers about possible risks linked to leaked trading details.
So, clients should check their trading history and account balance if they have used the affected service. If they see trades that they have not executed, they need to contact their broker. They should also reset their password at a different device and close all their open sessions.
GMO suggests the use of two-factor authentication whenever possible. This option adds another layer of security apart from the traditional password. Users should also change passwords that they have reused, & activate antivirus scans on devices they connected to the service.
The company has warned people not to visit the website of the attacker or spread links to the leaked files. It says the website collected information about visitors. Anyone who visits should run a full antivirus scan.
GMO Plans Compensation and a Safer Replacement Service
GMO says it will pay ¥5,000 to every current customer of the affected service, even if the customer suffered no financial loss. It also plans to cover confirmed losses and fees from unauthorized trades linked to the breach.
Customers whose information appears in the published material may receive another ¥10,000 to ¥25,000 for each type of information confirmed as leaked. However, GMO has not confirmed the total number of affected customers or the full scope of the exposure.
In addition, the company will not restart the affected systems in their previous form. Customers who still need an online Windows computer can move to a separate service, which GMO plans to offer free for six months.
The company will provide migration details and explain the available options. Customers must agree before moving to the replacement service.
For now, investigators still need to establish how the attackers entered the system and what information they took. GMO is working with authorities while trying to reduce further harm to customers.
