Japan's GMO offers up to $1 million bounty after breach of its FX trading cloud

GMO Internet Group, one of Japan's largest internet and foreign-exchange trading companies, is offering a bounty of up to $1 million for information leading to the arrest of the attackers who breached its Onamae.com Desktop Cloud service, according to The Hacker News. The breach, first detected on October 20, 2026, exposed customer data and triggered unauthorized trades on some customers' FX accounts.

What happened

Per The Hacker News, GMO found on October 20 that a third party had installed malicious programs on some customers' servers hosted on Onamae.com Desktop Cloud, a service that provides Windows desktops used for foreign-exchange trading. The company shut down servers across all plans on October 21 and says it received an extortion demand of roughly $50 million (about 8 billion yen) from those it believes carried out the attack. GMO counts 26,739 servers as potentially affected, while stressing this figure is not a count of confirmed intrusions or data thefts. On October 24 the company confirmed unauthorized access and the exfiltration of customer information.

Who is affected

The Hacker News reports the attackers threatened more than 70 securities and FX firms. OANDA Japan and FXTF were named as affected brokers, and OANDA said unauthorized logins used ID and password pairs it believes came from GMO's servers. Anything stored on the servers may have been viewed, including login credentials saved in the MetaTrader 4 and 5 terminals. GMO says it does not store customers' payment card data on the servers. The attackers set a noon October 27 deadline to publish customer data and deploy ransomware; GMO says no ransomware attack had been confirmed, and the attackers' domain and mirror sites were taken down around 4 a.m. Japan time on October 28.

The $1 million bounty

According to The Hacker News, the GMO Cybercrime Bounty pays up to $1 million in total, but only if a tip leads to an arrest — including by police outside Japan — or to an international wanted notice such as an Interpol Red Notice. Tips can be anonymous and are accepted in Japanese, English, or Chinese, and the program runs until an arrest or wanted notice, or until October 27, 2027. Company head Masatoshi Kumagai said in an October 25 blog post that GMO's own white-hat team had warned the service team about problems in advance. No specific attacker group or ransomware family has been named, and GMO has not publicly confirmed how the intruders got in.

What to do

GMO says it will not restart the breached systems as they are and will offer affected customers a move to a separate Windows desktop service, free for six months. The Hacker News notes GMO will pay every current user 5,000 yen, cover confirmed unauthorized trading losses and fees, and pay 10,000 to 25,000 yen per confirmed exposed information type. FX traders who used the service should rotate all credentials, especially any saved inside trading terminals, enable multi-factor authentication where available, and watch closely for unauthorized account activity.