GMO Internet Offers $1 Million Bounty to Catch Attackers Behind Desktop Cloud Breach

Japan's GMO Internet Group has launched a cybercrime reward program offering up to $1 million for information that helps authorities identify and arrest the individuals behind a breach of its Onamae.com Desktop Cloud service.

Announced on October 28, 2026, the GMO Cybercrime Bounty program follows an extortion attempt in which the attackers reportedly demanded approximately $50 million, or ¥8 billion, from the company. GMO has refused to pay the ransom and is seeking information that could lead to arrests or international wanted notices.

The affected service provides Windows-based virtual desktops used by customers, including foreign exchange (FX) traders. The breach has raised concerns about the exposure of customer information and the possible theft of trading credentials used to access financial accounts.

How the $1 Million Cybercrime Bounty Works

GMO Internet Group will fund and administer the reward program, which remains open until an arrest, the issuance of an international wanted notice, or October 27, 2027, whichever occurs first.

Eligible individuals can submit tips through the program's dedicated website. Submissions are accepted in Japanese, English, and Chinese, and anonymous reporting is permitted.

The company is seeking credible information that connects individuals, servers, domains, IP addresses, online accounts, or cryptocurrency wallets to the breach, extortion activities, or movement of criminal proceeds. Evidence explaining how the attack was conducted may also qualify.

Rewards will be paid only when submitted information contributes to an arrest, including an arrest outside Japan, or an international wanted notice, such as an Interpol Red Notice. GMO will determine the contribution of each tip, with a maximum total payout of $1 million. The amount may go to one individual or be divided among multiple contributors.

Applicants must establish their identities before receiving payment. If no submission meets the program's requirements, no reward will be issued.

The program excludes individuals involved in the crimes, people who obtained information illegally, including by purchasing stolen data, and GMO employees. The company has also warned participants not to hack systems, negotiate with or pay the attackers, or submit stolen credentials, leaked data, or malware.

GMO will share relevant information with law enforcement agencies in Japan and other countries as necessary. It has already provided authorities with evidence related to the threats, including communication records.

Breach Exposed Thousands of Servers to Potential Risk

GMO Internet, the subsidiary operating Onamae.com Desktop Cloud, discovered on October 20 that a third party had installed malicious programs on some customer servers.

The company subsequently shut down servers across all plans beginning October 21. It identified 26,739 servers as potentially affected, although this figure does not mean every server was compromised or that information was stolen from every affected environment.

On October 24, GMO confirmed a security problem involving the service's systems, unauthorized access, and the extraction of customer information from the company.

Data stored on customer servers may have been accessible to the attackers. This includes credentials saved in trading applications such as MetaTrader 4 and MetaTrader 5. GMO stated that customer payment card information was not stored on these servers.

As of October 28, the company had not publicly established the full extent of the breach, the total number of affected customers, or the complete scope of the information exposed.

Unauthorized FX Trades Raise Financial Security Concerns

Reports of suspicious financial activity began emerging on October 21, with some customers identifying trades they did not recognize.

Japanese brokerage OANDA Japan confirmed that a third party had accessed and traded through some customer accounts using ID and password combinations believed to have been exposed through the GMO servers. The broker restricted trading on potentially affected accounts and reported that, as of October 26, it had not identified a compromise or information leak within its own core systems.

Another broker, FXTF, warned customers on October 22 that attackers might have obtained credentials belonging to clients who used virtual private servers (VPS) provided by another company. It advised affected users to change their passwords from devices that had never connected to Desktop Cloud.

The incidents demonstrate how a compromise of a virtual desktop environment can extend beyond the hosting provider, potentially exposing credentials and enabling unauthorized access to third-party financial services.

GMO has not yet confirmed how many customers will qualify for compensation or the total amount it may have to pay. It is also reviewing which unauthorized trades can be directly attributed to the breach.

Attackers Threatened Data Publication and Ransomware

According to GMO, the attackers threatened to continue manipulating customer accounts associated with more than 70 securities and foreign exchange firms. They also threatened to publish information about the company and customers' computers, deploy ransomware against those computers, and disclose details about GMO's internal systems.

The attackers reportedly set a deadline of noon on October 27 to publish customer information and launch a ransomware attack.

As of 1:55 p.m. Japan time on October 27, GMO had not confirmed that a ransomware attack had occurred. Later that day, the attackers published material on their website that they claimed contained information belonging to GMO and its customers.

GMO said the attackers collected information about visitors to their website. The company has advised people not to access the site or its replacement domains and warned against reposting or linking to the published material. Visitors who may have accessed the site have been advised to run a full antivirus scan.

The attackers' website, including its mirror sites, was shut down at approximately 4 a.m. Japan time on October 28. GMO said it would take action against any replacement sites.

Entry Point Remains Unconfirmed

As of October 28, GMO had not publicly confirmed how the attackers initially gained access to its systems.

In an October 25 blog post, GMO Internet Group head Masatoshi Kumagai said the group's white-hat hackers had previously warned the team responsible for the service about security problems. He acknowledged that the response was not sufficiently fast or comprehensive, allowing attackers to exploit the gap.

The attackers reportedly claimed that an administrator account was shared across servers and that customers' computer drives were accessible from the servers by default when users connected. They also alleged that a vulnerability in the service enabled access to customers' personal computers.

However, GMO had not independently confirmed these claims, and the precise attack vector remained undisclosed.

The company has collected computers from customers who volunteered them for forensic examination. In the devices it had completed checking by October 27, it reported finding no malware, including ransomware. The investigation remained ongoing, and those results do not establish that all customer devices were unaffected.

GMO Announces Compensation for Affected Customers

GMO Internet Group has outlined compensation measures for customers affected by the incident.

The company said it would pay ¥5,000 to every current user and cover verified trading losses and fees resulting from unauthorized transactions that it confirms were caused by the breach.

Customers whose information is confirmed to have been published will also receive compensation ranging from ¥10,000 to ¥25,000 for each category of exposed information.

The company has not yet finalized the number of eligible customers or the total financial impact of the incident.

GMO has also confirmed that it will not restart the service using the compromised systems in their existing state. Customers who still require a Windows desktop will be offered migration to a separate service, free of charge for six months and only with their consent. Further details were expected by October 30.

Security Recommendations for Desktop Cloud Customers

GMO has advised customers to take immediate steps to protect their trading accounts and connected devices.

Recommended actions include:

• Change trading credentials: Reset passwords for brokerage accounts and trading software using a device that was never connected to Desktop Cloud, such as a smartphone.
• Terminate active sessions: Log out of all existing sessions, contacting the broker if necessary.
• Review trading activity: Check account balances and transaction histories, and report unauthorized trades directly to the relevant brokerage.
• Enable two-factor authentication: Use additional authentication protections wherever available.
• Update reused passwords: Change credentials that were reused across services or stored in browsers.
• Scan connected devices: Run a full antivirus scan on computers and other devices used to access the affected service.
• Back up important files: Preserve essential data while taking appropriate security precautions.
• Avoid attacker communications: Do not open suspicious links or files or respond to individuals claiming responsibility for the breach.
• Beware of recovery scams: Ignore offers to recover stolen funds in exchange for a fee.

GMO has also warned that it will never request passwords, authentication codes, or fees from individuals submitting information to its bounty program. Official communications from the program will come only from email addresses ending in @cybercrimebounty.gmo.

The incident highlights the potential consequences of compromised virtual desktop infrastructure, particularly when customers use hosted Windows environments to access financial accounts. While GMO's reward program aims to help authorities identify those responsible, the investigation into the breach, the scope of the data exposure, and the full financial impact remains ongoing.