GMO Internet Group Offers $1 Million Bounty for Hackers Behind FX Trading Cloud Breach
Japan's GMO Internet Group is offering up to $1 million for information leading to the arrest of attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay a $50 million extortion demand.
Japan's GMO Internet Group has launched an unprecedented bounty program, offering up to $1 million for actionable intelligence that leads to the arrest or international wanted notice of the cybercriminals responsible for breaching its Onamae.com Desktop Cloud service. This move comes after the company refused to meet a hefty extortion demand of approximately $50 million (¥8 billion) from the attackers, who had threatened both GMO and its customers.
The breach, discovered on October 20, affected a Windows desktop service used primarily for FX trading. The attackers gained unauthorized access and exfiltrated customer information, including credentials that may have been stored in trading software like MetaTrader 4 and 5. This has led to reports of unauthorized trades on some customer accounts, with brokers like OANDA Japan and FXTF confirming suspicious activity linked to credentials potentially leaked from GMO's service.
GMO's "GMO Cybercrime Bounty" program, which opened on October 28, accepts tips in Japanese, English, or Chinese and can be submitted anonymously via a dedicated website. The bounty is contingent on the tip leading to an arrest or an international wanted notice, with the reward amount determined by GMO based on the tip's contribution. The program is set to run until October 27, 2027, unless an arrest is made sooner. GMO explicitly warns tipsters against illegal activities such as breaking into systems, negotiating with attackers, or purchasing leaked data.
Following the breach confirmation on October 24, attackers posted what they claimed was sensitive information about GMO and its customers on their website. GMO has been actively working to shut down these sites and any mirror domains. The company has also stated that it has already provided all collected evidence, including communication records, to law enforcement agencies in Japan and abroad.
While GMO has not yet disclosed the exact method of initial compromise, the group's own white-hat hackers had reportedly warned the service's administrators about existing vulnerabilities prior to the attack. The attackers, on their own platforms, claimed to have exploited a flaw that allowed them to access customer PC drives by default and utilized a shared administrator account across all affected servers.
As of October 28, GMO had not confirmed the total number of affected customers, the extent of data published, or the specific trades that would qualify for compensation. The company is investigating the full impact on its services and customer data, emphasizing that payment card data is not stored on the affected servers. The incident highlights the growing sophistication of cyber threats targeting financial trading infrastructure and the increasing willingness of companies to engage the public in tracking down cybercriminals.
The attackers had threatened to continue manipulating customer accounts across numerous financial firms, deploy ransomware, and publish further details about GMO's systems. While a ransomware attack was not confirmed by the afternoon of October 27, the threat remains significant, underscoring the urgency of apprehending the perpetrators.