- Messages
- 4,011
- Likes
- 1,873
- Points
- 2,130
Japanese internet holding GMO Internet Group has offered a reward of up to $1 million for information on the hackers who breached its Onamae.com Desktop Cloud service. The attackers previously stole customer data, demanded a ransom of 8 billion yen (approximately $50 million), and threatened to launch ransomware on GMO clients' computers.
Onamae.com is a brand of GMO Internet, which operates one of the largest domain registration services in Japan. In addition to domains, the company offers hosting, DNS, and other infrastructure services. Onamae.com Desktop Cloud, owned by the holding, is a service offering virtual Windows desktops, which are used, among other things, for trading in financial markets.
On October 20, 2026, specialists from GMO Internet, which operates the service, discovered malware on client servers. The attack potentially affected 26,739 servers , and the service was temporarily suspended on October 21.
Further investigation confirmed unauthorized access to the infrastructure and the theft of user data. For example, the attackers may have obtained credentials for MetaTrader 4 and 5 (MT4/MT5) trading platforms, as well as trading account information. However, the company assured that users' payment information was not compromised.
The company also reported that the hackers demanded a ransom of 8 billion yen, and GMO representatives emphasized that they would not pay the attackers.
Shortly after the attack, GMO clients began complaining about suspicious transactions in their accounts, and brokerage firm OANDA Japan confirmed that unknown individuals used credentials allegedly stolen from Onamae to access client accounts and execute trades. They emphasized that no signs of hacking the broker's own systems were found.
Meanwhile, the hackers who attacked the company threatened to publish the stolen information publicly and, on October 27, to activate ransomware installed on clients' machines during an earlier stage of the attack. Because of this, GMO urged users to back up their data in advance, then disconnect their devices from the internet and unplug them. The company later reported that the attackers had kept their promise and, on October 27, had indeed published data purportedly belonging to GMO and its clients. However, the authenticity of the published information has not yet been confirmed. Furthermore, the ransomware attack announced by the hackers never took place, and specialists found no traces of malware on the computers they had already scanned (the company had confiscated the computers from users for analysis).
Although the hackers' website domain where the stolen information was published and its mirror sites were blocked on October 28, GMO warned media and users that the resource had collected visitor data and urged them not to click on links to it. The company also demanded that the leaked materials not be distributed and warned of possible legal action against anyone who publishes or forwards this data.
The company refused to pay the ransom but promised to compensate customers for the damage caused by the attack. Each active user of the service will receive 5,000 yen (approximately $30), and victims of the confirmed leak will receive an additional payment of 10,000 to 25,000 yen (approximately $60-$150) for each category of data published. GMO also intends to compensate confirmed losses from unauthorized transactions.
GMO also announced a reward of up to $1 million for information leading to the capture of the hackers behind the attack. The initiative is called the GMO Cybercrime Bounty . A reward will be offered only for information that actually leads to the arrest of the suspects or contributes to their international wanted list. Information is accepted anonymously, in Japanese, English, and Chinese, until October 27, 2027.
According to the latest reports from GMO representatives, as of October 29, approximately 270 tips had already been received through the Cybercrime Bounty. It is also noted that GMO's in-house security team has received information that could help identify the perpetrators, and this data has already been forwarded to the police.
Onamae.com is a brand of GMO Internet, which operates one of the largest domain registration services in Japan. In addition to domains, the company offers hosting, DNS, and other infrastructure services. Onamae.com Desktop Cloud, owned by the holding, is a service offering virtual Windows desktops, which are used, among other things, for trading in financial markets.
On October 20, 2026, specialists from GMO Internet, which operates the service, discovered malware on client servers. The attack potentially affected 26,739 servers , and the service was temporarily suspended on October 21.
Further investigation confirmed unauthorized access to the infrastructure and the theft of user data. For example, the attackers may have obtained credentials for MetaTrader 4 and 5 (MT4/MT5) trading platforms, as well as trading account information. However, the company assured that users' payment information was not compromised.
The company also reported that the hackers demanded a ransom of 8 billion yen, and GMO representatives emphasized that they would not pay the attackers.
Shortly after the attack, GMO clients began complaining about suspicious transactions in their accounts, and brokerage firm OANDA Japan confirmed that unknown individuals used credentials allegedly stolen from Onamae to access client accounts and execute trades. They emphasized that no signs of hacking the broker's own systems were found.
Meanwhile, the hackers who attacked the company threatened to publish the stolen information publicly and, on October 27, to activate ransomware installed on clients' machines during an earlier stage of the attack. Because of this, GMO urged users to back up their data in advance, then disconnect their devices from the internet and unplug them. The company later reported that the attackers had kept their promise and, on October 27, had indeed published data purportedly belonging to GMO and its clients. However, the authenticity of the published information has not yet been confirmed. Furthermore, the ransomware attack announced by the hackers never took place, and specialists found no traces of malware on the computers they had already scanned (the company had confiscated the computers from users for analysis).
Although the hackers' website domain where the stolen information was published and its mirror sites were blocked on October 28, GMO warned media and users that the resource had collected visitor data and urged them not to click on links to it. The company also demanded that the leaked materials not be distributed and warned of possible legal action against anyone who publishes or forwards this data.
The company refused to pay the ransom but promised to compensate customers for the damage caused by the attack. Each active user of the service will receive 5,000 yen (approximately $30), and victims of the confirmed leak will receive an additional payment of 10,000 to 25,000 yen (approximately $60-$150) for each category of data published. GMO also intends to compensate confirmed losses from unauthorized transactions.
GMO also announced a reward of up to $1 million for information leading to the capture of the hackers behind the attack. The initiative is called the GMO Cybercrime Bounty . A reward will be offered only for information that actually leads to the arrest of the suspects or contributes to their international wanted list. Information is accepted anonymously, in Japanese, English, and Chinese, until October 27, 2027.
According to the latest reports from GMO representatives, as of October 29, approximately 270 tips had already been received through the Cybercrime Bounty. It is also noted that GMO's in-house security team has received information that could help identify the perpetrators, and this data has already been forwarded to the police.