Summary
GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service. The reward program opened on October 28 and pays only if a tip leads to an arrest or an international wanted notice. GMO has refused to pay the extortion demand.
This follows the incident covered in our earlier report on GMO's shutdown request to customers.
What Happened
- October 20: GMO found that a third party had installed malicious programs on some customers' servers.
- October 21: Servers on every plan were shut down. GMO counts 26,739 servers as potentially affected, which is not the same as confirmed break-ins or data theft.
- Data theft and trading abuse: The attackers stole customer data, then used trading credentials stored on the rented servers to place unauthorized orders at brokerages. They have threatened to keep manipulating trading accounts at more than 70 securities and FX firms in Japan and abroad.
- October 27: The attackers posted material they say is GMO and customer information. The leak site's domain and mirror sites were taken down at about 4 a.m. Japan time on October 28.
The Extortion Demand
GMO's group CEO said the original demand was $50 million, and the company says it has not paid. The attackers reportedly claimed to have cut the demand to $1 million, but GMO has not confirmed that figure. The $1 million ransom claim and the $1 million bounty are separate amounts, and some outlets have mixed them up.
Compensation
GMO is offering ¥5,000 per user plus cover for confirmed trading losses.
Recommendations
- Treat any trading or broker credentials stored on shared or rented cloud desktops as exposed: rotate passwords, API keys, and MT4/MT5 logins.
- Enable multi-factor authentication and withdrawal or order-size limits at brokerages.
- Review account activity for unauthorized orders since October 20.
- Avoid downloading or sharing the leaked data, which may be used for follow-on phishing.