// AI threat desk · 28 Oct 2026
Home/LEAK · Data Leaks
Data LeaksMediumBREACHCVSS not assigned

GMO Internet Group reward program follows Onamae.com Desktop Cloud breach

GMO Internet Group opened a reward program offering up to $1 million after attackers breached its Onamae.com Desktop Cloud service, The Hacker News reported.

· 3 min read
AI-generated image of security analysts reviewing monitors during a cloud service breach response.
AI-generated image, not a photo of the event.
Key takeaways
  • The Hacker News said GMO Internet Group is offering up to $1 million for information that helps lead to an arrest or international wanted notice.
  • GMO Internet Group said it confirmed unauthorized access and exfiltration of customer information from the Desktop Cloud service.
  • OANDA Japan confirmed that a third party used credentials believed to have come from GMO servers to access and trade on some customer accounts.

GMO Internet Group launched a reward program on Oct 28, offering up to $1 million for information that helps lead to an arrest or international wanted notice after attackers breached its Onamae.com Desktop Cloud service, The Hacker News said.

The service hosts Windows desktops used for foreign-exchange trading. The Hacker News said attackers took customer information, while OANDA Japan confirmed that a third party used credentials believed to have come from GMO servers to access and trade on some customer accounts.

GMO Internet, the subsidiary that runs the service, found on Oct 20 that malicious programs had been installed on some customer servers. GMO later said it had confirmed unauthorized access and exfiltration of customer information, while The Hacker News said GMO had not disclosed how the attackers got in as of Oct 28.

On this page

The reward targets people, servers and cryptocurrency addresses linked to the attack

GMO Internet Group said tips should link people, servers, domains, IP addresses, accounts or cryptocurrency addresses to the attack, extortion or movement of money. It said one tipster can receive the full $1 million, or the reward can be split among tipsters.

The Hacker News said the reward pays only when a tip helps lead to an arrest or an international wanted notice. GMO Internet Group said submissions can be anonymous and sent by email to an address on a dedicated website.

Attackers posted customer material after demanding about $50 million

GMO Internet Group said it received a demand for about $50 million, or about ¥8 billion, on Oct 21 from people it believes carried out the attack. The Hacker News said the attackers posted material they said was information about GMO and its customers on Oct 27.

GMO Internet Group said it would pay every current user ¥5,000 and cover confirmed unauthorized trading losses and fees caused by the breach. It said customers whose information it confirms was published will receive ¥10,000 to ¥25,000 for each exposed information type, while affected users may receive up to ¥3 million each time their information is released.

GMO shut down 26,739 potentially affected servers

The Hacker News said GMO shut down servers on every plan from Oct 21 and counted 26,739 servers as potentially affected. It said customer-stored data, including credentials saved in trading software such as MetaTrader 4 and 5, may have been viewed, while GMO does not keep payment-card data on the servers.

OANDA Japan confirmed that a third party logged into and traded on some customers’ accounts using ID and password pairs it believes were leaked from GMO servers. The broker said that as of Oct 26 it had not found a break-in or leak in its own core systems.

GMO Internet Group said it had already given police its evidence about the threats, including communication records. It said the reward program accepts anonymous tips in Japanese, English or Chinese and remains open until an arrest, an international wanted notice or Oct 27, 2027, whichever comes first.

GMO Internet Group had not confirmed how many customers its payments would cover, how much information was published or which trades qualified for compensation. It also had not confirmed any impact on its other services.

What to do now

  1. Change trading-account and trading-software passwords from a device not used for FX trading, such as a phone.
  2. Check trading history and balances, and report unrecognized trades to the broker first.
  3. Change FXTF passwords from a device that had never connected to Desktop Cloud.

FAQ

What happened to GMO Internet Group’s Onamae.com Desktop Cloud service?

GMO Internet Group said it confirmed a security problem, unauthorized access and exfiltration of customer information. The Hacker News said GMO shut down servers on every plan from Oct 21.

How much is GMO offering for information about the attackers?

The Hacker News said GMO is offering up to $1 million in total. It said a tip pays only if it helps lead to an arrest or an international wanted notice.

Were customer trading accounts accessed?

OANDA Japan confirmed that a third party logged into and traded on some customer accounts using credentials it believes were leaked from GMO servers. GMO Internet Group said attackers threatened to keep manipulating accounts at more than 70 securities and foreign-exchange firms.

How many servers could be affected?

The Hacker News said GMO counted 26,739 servers as potentially affected. It said customer-stored data, including trading-software credentials, may have been viewed.

Did GMO confirm how the attackers entered the service?

The Hacker News said that as of Oct 28, GMO had not said how the attackers got in. It also said GMO had not publicly confirmed claims about a shared administrator account, default visibility of PC drives or a service flaw.

What should Desktop Cloud customers do about their passwords?

GMO Internet Group told customers to change trading-account and trading-software passwords from a device not used for FX trading, then end every logged-in session. It also told them to check trading history and balances and report unrecognized trades to their broker first.

Sources

  1. GMO、ランサム被害にあった顧客に新しいPC提供へ 犯行グループは1人の顧客情報公開か, GMO Internet GroupPrimary
  2. GMO熊谷代表「社内ホワイトハッカーが事前に指摘」も対策遅れ、国に「能動的サイバー防御」要請 「責任転嫁では」SNSで批判も, The attackersPrimary
  3. Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach, The Hacker News
  4. GMO to offer up to $1 million for info to identify hackers, NHK
How we checked this story
ClaimSourceStatus
The Hacker News said gMO Internet Group is offering up to $1 million for tips that help catch attackers who breached its Onamae.com Desktop Cloud service.The Hacker NewsAttributed
The Hacker News said the reward program opened on October 28 and pays only if a tip helps lead to an arrest or an international wanted notice.The Hacker NewsAttributed
The Hacker News said the service hosts Windows desktops used for FX trading, and a broker linked unauthorized trades to logins leaked from the service.The Hacker NewsAttributed
GMO said attackers took customer information and received a demand for about $50 million on October 21.GMO Internet Group, via The Hacker NewsAttributed
The Hacker News said the attackers posted material they said was information about GMO and its customers on October 27.The Hacker NewsAttributed
The Hacker News said the attackers' site and mirror sites were shut down at about 4 a.m. Japan time on October 28.The Hacker NewsAttributed
The Hacker News said gMO Internet found on October 20 that a third party had installed malicious programs on some customers' servers.The Hacker NewsAttributed
The Hacker News said gMO shut down servers on every plan from October 21 and counted 26,739 servers as potentially affected.The Hacker NewsAttributed
GMO said on October 24 that it had confirmed a security problem, unauthorized access and exfiltration of customer information.GMO Internet Group, via The Hacker NewsAttributed
The Hacker News said customers' stored data, including trading-software credentials, may have been viewed, while GMO does not keep payment-card data on the servers.The Hacker NewsAttributed
OANDA Japan confirmed that a third party logged into and traded on some customers' accounts using credentials it believes came from GMO servers.OANDA Japan, via The Hacker NewsAttributed
The Hacker News said as of October 26, OANDA Japan had not found a break-in or leak in its own core systems.The Hacker NewsAttributed
The Hacker News said gMO said it had not confirmed how attackers got in as of October 28.The Hacker NewsAttributed
GMO told customers to end every logged-in session, including through their broker if needed, after changing passwords.GMO Internet Group, via The Hacker NewsAttributed
GMO said it will pay every current user ¥5,000 and cover confirmed unauthorized trading losses and fees caused by the breach.GMO Internet Group, via The Hacker NewsAttributed
NHK reported that GMO said it would never comply with the hacker group's demand.GMO Internet Group, via NHKAttributed
NHK reported that GMO would make a goodwill payment of up to 3 million yen to each affected user whenever the group released information.GMO Internet Group, via NHKAttributed
GMO said the public should not repost the posted information to prevent it from spreading further.GMO Internet Group, via NHKAttributed
GMO said it would provide customers whose PCs suffered ransomware damage with new PCs of equivalent performance.GMO Internet GroupAttributed
GMO Internet Group said the attackers demanded about $50 million, or about ¥8 billion, on October 21.GMO Internet Group, via The Hacker NewsAttributed
GMO Internet Group said the reward program accepts tips in Japanese, English or Chinese and allows anonymous submissions.GMO Internet Group, via The Hacker NewsAttributed
GMO Internet Group said the reward program remains open until an arrest, an international wanted notice or October 27, 2027.GMO Internet Group, via The Hacker NewsAttributed
GMO wants tips linking people, servers, domains, IP addresses, accounts or cryptocurrency addresses to the attack, extortion or movement of money.GMO Internet Group, via The Hacker NewsAttributed
GMO says one tipster can receive the full $1 million, or the reward can be split among tipsters.GMO Internet Group, via The Hacker NewsAttributed
GMO has already given police all its evidence on the threats, including communication records.GMO Internet Group, via The Hacker NewsAttributed
The Hacker News said gMO found on October 20 that malicious programs had been installed on some customer servers.The Hacker NewsAttributed
GMO had not confirmed how many customers its payments would cover, how much information was published or which trades qualified for compensation.GMO Internet Group, via The Hacker NewsAttributed
GMO had not confirmed any impact from the breach on its other services.GMO Internet Group, via The Hacker NewsAttributed
GMO said attackers threatened to publish information about customers' PCs and hit those PCs with ransomware.GMO Internet Group, via The Hacker NewsAttributed
The Hacker News said the attackers set noon on October 27 as the deadline for publishing customer information and launching the ransomware attack.The Hacker NewsAttributed
The attackers posted what they called one customer's personal information on October 27, according to ITmedia NEWS.ITmedia NEWS, via The Hacker NewsAttributed
GMO told visitors to the attackers' site to run a full antivirus scan and not visit or spread material from it.GMO Internet Group, via The Hacker NewsAttributed
The Hacker News said the attackers claimed one administrator account was shared across all servers and customer PC drives were visible by default.The Hacker NewsAttributed
The Hacker News said the attackers claimed they used a service flaw to reach customers' own PCs.The Hacker NewsAttributed
The Hacker News said gMO had not publicly confirmed the attackers' claims about the administrator account, PC drives or service flaw.The Hacker NewsAttributed
The Hacker News said as of October 27 at 11:59 a.m. Japan time, GMO had found no malware on the customer PCs it had finished checking.The Hacker NewsAttributed
GMO said it would not restart the service on the breached systems as they were.GMO Internet Group, via The Hacker NewsAttributed
GMO planned to offer consenting customers a move to a separate Windows desktop service free for six months.GMO Internet Group, via The Hacker NewsAttributed
GMO said customers whose information it confirmed was published would receive ¥10,000 to ¥25,000 for each exposed information type.GMO Internet Group, via The Hacker NewsAttributed
The hacker group said the attackers threatened to release customer details if GMO did not respond by noon Tuesday.The hacker group, via NHKAttributed
GMO said it would pay affected users up to 3 million yen whenever the hacker group released their information.GMO Internet Group, via NHKAttributed
GMO said it would provide equivalent-performance replacement PCs to customers whose PCs were damaged by ransomware.GMO Internet GroupAttributed
The attackers claimed on their website that they exploited a Desktop Cloud vulnerability to enter customers' local PCs.The attackersAttributed
GMO said employees were collecting customer devices nationwide for analysis by its white-hat hacker team.GMO Internet GroupAttributed
The attackers claimed that all VPSs shared a common administrator account and local PC drives were visible by default.The attackersAttributed
ITmedia reported that GMO had not disclosed vulnerability details or established whether the attackers' configuration claims were correct.ITmedia NEWSAttributed
itmedia.co.jp published its report on Oct 27, 2026.itmedia.co.jpConfirmed
itmedia.co.jp published its report on Oct 26, 2026.itmedia.co.jpConfirmed

Could not verify

  • Whether the attackers exploited a confirmed vulnerability or configuration weakness is not established
  • Whether the attackers used AI is not established
  • How many customers and confirmed data records were affected is not established
  • Whether the posted information was authentic is not established
  • Whether any ransomware was deployed on customer PCs is not established
See all in Data Leaks →
Explore with AI
ChatGPT
Claude
Perplexity
Grok