Attackers who breached GMO Internet Group’s Onamae.com Desktop Cloud service published data they say belongs to the company and its customers, and GMO has responded with a bounty of up to $1 million for information leading to their arrest. The leak follows a warning that customers should shut down their PCs because of a ransomware payload planted on customer servers.
How the Onamae Desktop Cloud Extortion Escalated
GMO detected the intrusion on October 20, according to the company. The service hosts Windows desktops that customers use for foreign exchange trading through the MetaTrader 4 and MetaTrader 5 platforms. GMO said up to 26,739 customer servers could have received malware.
The attackers sent a ransom demand of about 8 billion yen, roughly $50 million, on October 21. GMO has said it will not pay.
Power-Off Order and Trend Micro Cleanup Work
On October 26, GMO warned that the attackers planned to leak customer data and to trigger a ransomware payload placed on customer servers. A day later the company asked customers to back up their data, disconnect from the internet, shut down their PCs and unplug cables before noon. GMO is carrying out the remediation work with Trend Micro.
Reporting on the incident indicates the ransomware payload appears never to have been activated on customer machines. The shutdown request was a precaution against a trigger that, on current evidence, did not fire.
Published Data and Trading Account Exposure
On October 27 the attackers posted material they say comes from GMO and its customers. GMO confirmed that company and customer data was published and said it is verifying the contents.
The company stated that payment information was not exposed. It said MetaTrader 4 and 5 credentials and trading account details may have been. A broker has linked unauthorized trades on some customer accounts to logins leaked from the service, according to reporting on the case.
That detail moves the incident beyond data exposure. Leaked trading logins are directly usable by anyone who obtains them, which is why the broker’s report of unauthorized trades carries weight for the customers involved.
GMO Cybercrime Bounty and Leak Site Takedown
At about 4 a.m. Japan time on October 28, GMO shut down the attackers’ leak site domain and its mirrors. The company said it will act against any new sites that appear.
Later the same day GMO launched the “GMO Cybercrime Bounty.” It offers up to $1 million in total for tips that lead to an arrest or an international wanted notice, such as an Interpol Red Notice. The program runs until an arrest, a notice, or October 27, 2027, whichever comes first.
Tips can be anonymous and can be submitted in Japanese, English or Chinese. One tipster can receive the full amount, or the sum can be split among several. People involved in the crime, and anyone who obtained information illegally, are not eligible.
Compensation, Replacement PCs and Legal Warnings
GMO earlier offered 5,000 yen, about $30, per customer in compensation and said it may add more for customers whose data was exposed. It offered replacement PCs to customers who were harmed. The company also warned that it will take legal action against people who spread the leaked data.
What the Case Shows About Extortion Against Hosting Providers
The sequence at GMO, from a ransom demand to a refused payment, a leak, and then a public bounty, shows an extortion crew losing leverage once a victim declines to negotiate and takes the leak site down. The takedown of the leak site domain within a day of publication limits how widely the material spreads, although mirrors and copies are difficult to remove entirely.
The scale of the exposure also matters. A service that hands out remote Windows desktops to traders concentrates credentials and account access in one environment, so a single intrusion reaches many customers at once. The 26,739-server figure is a ceiling on potential malware delivery, not a confirmed count of infected machines, and GMO has not said how many customers had data published.
Whether the bounty produces arrests will depend on tips that GMO has not yet described receiving. For now the open questions are the volume of leaked customer records, the number of trading accounts affected and how many unauthorized trades occurred.
The timeline also shows how compressed the pressure campaign was. Within eight days of detection, the attackers had issued a demand, threatened a payload trigger, published material and lost their leak site domain. GMO’s decision to pair the takedown with a public reward moves the response from containment toward pursuit of the people behind the attack, and the reward’s duration, which runs to October 27, 2027, indicates the company expects the search to be long. The bounty terms exclude anyone involved in the crime and anyone who obtained information illegally, which narrows the pool of eligible tipsters.
