GMO offers $1 million bounty over cloud service breach

Japan’s GMO Internet Group has launched a cybercrime bounty programme offering up to $1 million in total for tips that lead to an arrest or an international wanted notice in connection with the Onamae[.]com Desktop Cloud breach. The reward scheme, run under the GMO Cybercrime Bounty banner, commenced on 28 October 2026 and will pay only if a tip directly contributes to a successful arrest or an Interpol Red Notice, or similar international action.

GMO states the service hosts Windows desktops used for FX trading, and a broker linked unauthorized trades on some customers’ accounts to logins leaked from the Desktop Cloud environment. The company says attackers stole customer information and had demanded about $50 million (roughly ¥8 billion) on 21 October 2026.

GMO reported on 24 October that it had confirmed a security problem in the service, unauthorised access to the platform, and exfiltration of customer data. It has since disclosed that up to 26,739 servers were potentially affected, though this figure does not represent confirmed breaches or data theft.

Brokers OANDA Japan and FXTF have publicly tied certain trades to compromised login credentials believed to have been leaked from GMO systems, with FXTF advising customers to change passwords for affected connections. The attackers posted material claimed to contain information about GMO and its customers on 27 October, and GMO says the domain and mirrors were shut down around 04:00 local time on 28 October, with plans to address any new sites.

GMO also notes it has provided police with evidence, including communication records, and that payments to qualifying tipsters will cover actual unauthorized trading losses and specific information disclosures.