GMO Refuses $50 Million Ransom and Posts $1 Million Bounty as Stolen FX Data Leaks

GMO Internet Group has turned a routine customer inquiry into one of the most public extortion fights a Japanese internet company has faced. The inquiry concerned Onamae.com Desktop Cloud, a service that rents Windows desktops to retail foreign exchange traders. On October 20 the company confirmed that an unauthorized program had been installed in some customer server environments, and by the following morning it had suspended the service on every plan.

The sequence that followed mixed criminal extortion with corporate crisis management. An attacker demanded about 8 billion yen, roughly $50 million, in cryptocurrency, and GMO refused to pay. On October 27 the attacker began publishing material said to come from GMO and its customers, beginning with a single profile that carried a photograph, a name, an address, shopping habits and the financial institutions and services the person uses. The group threatened to release one new victim each day until it was paid.

By the morning of October 28 the leak site and its mirrors had gone dark, taken down at about 4 a.m. Japan time, and GMO had announced a reward program aimed not at recovering the data but at catching the people behind the intrusion. The company also set out compensation for customers and warned that anyone who reposts the stolen material could face a criminal complaint.

The case reaches past one company because the affected machines were trading terminals. Credentials saved in MetaTrader 4 and MetaTrader 5 were among the data exposed, and at least one broker has linked unauthorized trades on customer accounts to logins that appear to have leaked from the service.

Key Facts

GMO Internet, the listed subsidiary that operates the service, counts 26,739 servers as potentially affected. The company is explicit that this is not the number of confirmed break-ins or thefts, only the population that has to be treated as exposed. The official timeline runs from October 21, when the service was suspended at 04:00 and the first extortion email arrived, through October 22, when police were consulted at 13:00, to October 27, when publication of stolen data was confirmed at 13:55.

Kyodo News reported on October 27 that the demand was for $50 million, a figure GMO chief executive Masatoshi Kumagai put at about 8 billion yen in cryptocurrency in a blog post, adding that the firm will not pay. The same report said the company will pay up to 3 million yen, about $19,000, to victims whose personal information is confirmed exposed. GMO later broke that down into a flat 5,000 yen for every current user, plus 10,000 yen where names and contact details were exposed, 15,000 yen for financial or authentication data such as trading account IDs and passwords, and 25,000 yen for highly private information, capped at 3 million yen per disclosure.

GMO Internet said in its fourteenth report, published on October 28, that the GMO Cybercrime Bounty site opened at 12:00 JST with a maximum total reward of $1 million, about 150 million yen, and had logged 113 tips within six hours. Kyodo News reported on October 27 that tips will be accepted in Japanese, English or Chinese and that the program runs from noon Wednesday until the perpetrators are arrested. GMO said the bounty stays open until an arrest or an international wanted notice, and no later than October 27, 2027, with a running count published every weekday at 18:00.

GMO wants information that ties people, servers, domains, IP addresses, accounts or cryptocurrency addresses to the attack, the extortion or the movement of funds. The Hacker News reported on October 28 that payment depends on a tip helping to produce an arrest or an international wanted notice, not merely on identifying a suspect. Separately, GMO said it had sent 20 warning notices to X posts that spread the URL or contents of the attackers' site, arguing that sharing feeds the extortion and widens the harm to customers.

The Japan Times reported on October 28 that GMO confirmed the shutdown of the website the attackers used to leak data, and that a profile published a day earlier contained inaccurate details. Analysis of customer devices collected so far has found no traces of malware infection or ransomware, according to GMO, and the investigation continues. On the financial side, Finance Minister Satsuki Katayama said five FX trading firms using the GMO service had been affected, among them OANDA Japan, Ava Trade Japan and Goldenway Japan, which trades as FXTF. OANDA Japan confirmed that a third party logged in and traded on some accounts using ID and password pairs believed to have leaked from the GMO servers, and restricted trading on possibly affected accounts.

Analysis

The arithmetic of the standoff is unusually stark. A demand of about 8 billion yen against a bounty capped at roughly 150 million yen means GMO has chosen to spend around two percent of the ransom figure on intelligence instead of capitulating. That is a deliberate bet that the group can be located, and that people who know where it is are more likely to talk to a company than to a police force working across borders. The bigger picture here is that GMO has decided the cheapest route out of the crisis is to buy information rather than silence.

The compensation schedule tells its own story. The company is not paying everyone the same amount: 5,000 yen is a gesture, 25,000 yen is an acknowledgment that a person's most sensitive records left the building. The 3 million yen ceiling matters as much as the tier structure, because it caps the company's exposure to any single catastrophic disclosure at about $19,000. For a breach that touched more than 26,000 servers, that is a modest per person liability, and it is a number regulators and plaintiff lawyers will both study.

Enforcement is the weaker leg of the strategy. A bounty only converts into a result if someone is arrested or placed on an international wanted list, and neither outcome is within GMO's control. The Japan Times reported on October 28 that GMO had asked the Japanese government over the weekend for active cyberdefense measures, and that the government declined to comment on any specific response, saying decisions on neutralizing attackers' infrastructure rest with the relevant authorities. The company can publish tip counts every weekday at 18:00, but it cannot publish an arrest.

There is also a speech question buried in the response. Sending 20 warning notices to X posts that circulated the leak site is a defensible attempt to slow the spread of stolen data, and GMO has paired it with the threat of criminal complaints. But a company that asks a platform to remove links is asking a private intermediary to police a crime scene, and the line between suppressing stolen material and suppressing reporting about the breach is not one GMO gets to draw alone.

Why It Matters

Japan's retail foreign exchange market runs on desktop trading software, and a large share of it runs on rented Windows machines rather than on hardware in a customer's home. When a hosting provider for those desktops is compromised, the loss is not a database of email addresses. It is a working set of broker logins, saved in MetaTrader 4 and MetaTrader 5, that can be replayed against live accounts. OANDA Japan's confirmation that unauthorized trades followed logins believed to have leaked from GMO is the practical version of that risk.

For the brokers, the breach arrives as a third party problem that behaves like an in house one. Customers reported unrecognized trades from October 21, the same day the service went down. FXTF warned on October 22 that third parties may have stolen logins from customers using VPS servers. Five firms have now told the Financial Services Agency that their customers were affected, which puts the incident inside the supervisory conversation about operational resilience rather than outside it.

For the wider market, the precedent is about incentives. A company that refuses a $50 million demand, publishes a bounty and promises tiered compensation has given future victims a template, and future attackers a data point about how Japanese firms may respond.

Next Up

The near term calendar is set by GMO's own disclosure promise: a tip count every weekday at 18:00, continued device analysis, and a compensation process that opened after the October 27 announcement of payment tiers. The company has said it may file criminal complaints against people who post, reproduce or disseminate the leaked material, so the next legal move could target readers and reposters rather than the intruders. The Metropolitan Police Department is reportedly taking protective measures for affected clients, and GMO consulted police on October 22.

The longer horizon runs to October 27, 2027, the outer limit GMO has set for the bounty. Open questions remain: whether device analysis stays clean, whether more than five brokers disclose affected customers, and whether the takedown of the leak site holds or is replaced by mirror sites, a possibility GMO has already warned about.