GMO Offers $1M Bounty to Catch Hackers
GMO Internet Group Offers $1M Bounty After Refusing Ransom Demand
Related Entities
Products & Tech
Other
Full Report
Executive Summary
In a decisive response to a cyber extortion attempt, Japan's GMO Internet Group has publicly refused a ransom demand of approximately ¥8 billion (around $50 million) following a security breach of its "Onamae.com Desktop Cloud" service. The company has instead opted for a proactive and public strategy, announcing a reward of up to $1 million for information leading to the arrest of the perpetrators. The incident, which affected a cloud service popular for automated foreign exchange (FX) trading, resulted in unauthorized trades and data theft. GMO is also compensating affected customers and has successfully taken down the attackers' leak site, marking a strong public stance against paying ransoms.
Incident Timeline
- Prior to Oct 21: Customers of the Onamae.com Desktop Cloud service begin reporting unauthorized trades in their FX accounts, with one victim reporting losses of ~1.2 million yen.
- Oct 21, 2026: The attackers contact GMO Internet Group, demanding a ransom of ~$50 million and threatening to leak stolen customer data and launch ransomware attacks.
- Post Oct 21: GMO refuses to engage or pay the ransom.
- Oct 27, 2026: The attackers follow through on their threat and begin publishing stolen customer data on a dedicated leak site.
- Oct 27-28, 2026: GMO announces its "GMO Cybercrime Bounty" program and customer compensation plan.
- Oct 28, 2026 (morning): GMO, in collaboration with other companies, successfully gets the attackers' leak domain and its mirrors suspended.
Response Actions
GMO's handling of this incident is a case study in an alternative, non-payment response strategy:
- Refuse and Resist: The company made a clear decision not to pay the massive ransom demand, removing the primary financial incentive for the attackers.
- Launch Public Bounty: By offering a $1 million reward, GMO is attempting to crowdsource intelligence and incentivize insiders or law enforcement informants to come forward. They are seeking information on individuals, servers, IP addresses, or cryptocurrency accounts linked to the attack.
- Customer Compensation: GMO is proactively addressing customer harm by offering a flat payment of ¥5,000 to all users, additional payments (up to ¥25,000) for those whose data was exposed, and reimbursement for losses from fraudulent trades. This aims to maintain customer trust and mitigate legal liability.
- Disrupt Attacker Infrastructure: The company actively worked to take down the leak site, disrupting the attackers' ability to publicize the breach and apply pressure.
Technical Findings
The attack targeted the Onamae.com Desktop Cloud service, a Windows-based virtual desktop environment often used by retail traders to run automated trading software like MetaTrader 4 (MT4) and MetaTrader 5 (MT5). The attackers gained access to these environments, allowing them to execute fraudulent trades and exfiltrate customer data. The exact initial access vector was not disclosed, but it was sufficient to compromise multiple customer instances, leading to both financial theft (T1657 - Financial Theft) and data extortion (T1486 - Data Encrypted for Impact).
Lessons Learned
- Non-Payment is a Viable Strategy: GMO's response demonstrates that refusing to pay a ransom, while carrying risks like data leakage, can be part of a robust incident response strategy. It avoids funding criminal enterprises and can be paired with other actions.
- Public Communication and Transparency: By publicly announcing the breach, the bounty, and the compensation plan, GMO took control of the narrative, positioning itself as a proactive defender of its customers rather than a passive victim.
- Bounties as an IR Tool: Using a financial bounty to generate leads is an unconventional but potentially effective tool in identifying anonymous threat actors, especially when traditional forensic methods are challenging.
Mitigation Recommendations
- For Cloud Service Providers: Providers of virtual desktop infrastructure (VDI) or similar services must implement strong tenant isolation and robust authentication controls. Regular security audits and penetration tests of the management plane and hypervisor infrastructure are essential.
- For End Users: Users of remote desktop and VDI services should always enable Multi-Factor Authentication (MFA) if available. They should also use unique, strong passwords for these services and monitor their accounts for any suspicious activity.
Timeline of Events
MITRE ATT&CK Mitigations
Multi-factor Authentication
Enforcing MFA on cloud desktop services can prevent account takeover even if credentials are stolen.
Mapped D3FEND Techniques:
Regularly audit and monitor logs for suspicious access patterns and unauthorized activities.
Network Segmentation
Ensure strong logical separation (tenant isolation) between different customers on a shared cloud platform.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
For a service like Onamae.com Desktop Cloud, which provides access to sensitive financial trading platforms, mandating Multi-Factor Authentication (MFA) is the single most effective countermeasure. This incident, involving unauthorized trades, was likely enabled by compromised credentials. Had MFA been enforced for every login to the cloud desktop, the attackers would have been unable to access customer sessions even with valid usernames and passwords. GMO should enforce MFA for all users, and users of any similar VDI or remote access service should enable it immediately. This control moves security beyond just knowledge-based factors (passwords) and adds a possession-based factor (like a TOTP app), creating a significant barrier to account takeover.
Implementing User Behavior Analysis (UBA) on the Onamae.com platform could have provided early detection of the compromise. A UBA system would baseline the normal login locations, times, and in-session activities for each user. When the attackers logged into customer accounts from anomalous IP addresses or geographic locations, the system would generate an alert. Furthermore, if the attackers' trading activity—such as liquidating all assets or making trades inconsistent with the user's history—deviated from the established pattern, the UBA platform could flag this as high-risk behavior. This would allow GMO's security team to investigate and potentially lock the compromised accounts before significant financial losses occurred, mitigating the impact of the breach.
Timeline of Events
Attackers contact GMO Internet Group with a ransom demand of approximately $50 million.
Attackers begin leaking stolen customer data on a dedicated website after GMO refuses to pay.
GMO confirms the attacker's leak site has been suspended and formally announces its $1 million bounty program.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.