Fast Facts
-
GMO is offering up to $1 million for credible tips leading to an arrest or international wanted notice after attackers demanded about $50 million.
-
The Desktop Cloud breach may affect 26,739 servers. Stolen customer data and trading logins have been linked to unauthorized trades; the full impact remains unknown.
-
GMO shut down the service and is investigating. Attackers threatened further leaks and ransomware, but the breach method and claims about compromised customer PCs remain unconfirmed.
- Customers should change passwords, end active sessions, enable two-factor authentication, and check accounts. GMO says it will compensate users and cover verified breach-related trading losses.
Japan’s GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach
A Reward for Actionable Tips
Japan’s GMO Internet Group is offering up to $1 million for information that helps authorities identify and arrest the people behind a breach of its Onamae.com Desktop Cloud service. The program opened on October 28 and runs until an arrest, an international wanted notice, or October 27, 2027.
GMO will pay only for tips that lead to one of those outcomes. It may award the full amount to one person or divide it among several tipsters. The company wants evidence connecting people, online accounts, servers, or cryptocurrency addresses to the attack or its proceeds—not guesses or information already available publicly.
Tipsters can contact GMO anonymously in Japanese, English, or Chinese. However, they must prove their identity to receive payment. GMO also warns people not to hack systems, contact the attackers, or buy leaked information.
The company has not confirmed how the attackers entered the service. GMO’s group head has acknowledged that staff did not respond quickly or thoroughly enough to earlier security warnings. The attackers have made claims about weaknesses in the service, but GMO has not verified them.
Trading Accounts and Customer Risks
GMO says the attackers stole customer information and demanded about $50 million. The service provided Windows desktops that customers used for foreign-exchange trading. GMO identified 26,739 servers as potentially affected, but that figure does not mean attackers broke into every server or stole data from every customer.
Some customers reported trades they did not recognize. Broker OANDA Japan confirmed that someone used login details it believes came from the breached servers to access and trade on some customer accounts. It restricted trading on accounts that might face risk. GMO has not yet confirmed the full scope of the leak or which losses qualify for compensation.
Meanwhile, customers should change trading passwords from a separate device, end active sessions, review account activity, and turn on two-factor authentication where available. These steps can reduce risk, though they cannot undo trades that already occurred. GMO says it will pay current users ¥5,000 and cover verified trading losses and fees caused by unauthorized trades.
Cloud desktops can make trading and other online work more convenient. However, this incident shows why users and service providers must protect stored passwords and respond quickly to security warnings.
Continue Your Tech Journey
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Access comprehensive resources on technology by visiting Wikipedia.
DataProtection-V1
