The service operator says the attackers' site domains were taken down. It also plans a consent-based move for customers to a separate service, with details due October 30.
Japan’s GMO Internet Group opened a bounty programme on October 28 offering up to $1 million in total for information that helps lead to an arrest or international wanted notice over the attack on Onamae.com Desktop Cloud.
The group runs and funds GMO Cybercrime Bounty, The Hacker News said. Its subsidiary GMO Internet operates Desktop Cloud, which hosts remote Windows desktops used for foreign-exchange (FX) trading.
The response follows GMO Internet’s discovery of malicious programs on customer servers on October 20 and its shutdown of servers across all service plans from October 21. On October 24, the company confirmed a security problem, unauthorized access and the theft of customer information.
GMO Internet said the domains of the attackers' website and its mirror sites—copies hosted at other addresses—were taken down at about 4 a.m. Japan time on October 28. The sites had carried material the attackers described as information about GMO and its customers, posted on October 27. GMO has not announced an arrest, an international wanted notice or the recovery or deletion of stolen data.
The company said it received an extortion demand for about $50 million, or ¥8 billion, on October 21 from people it believes carried out the attack. It refused to pay, saying payment would not guarantee deletion of the information or prevent its misuse.
GMO said the extortionists threatened further manipulation of customer accounts at more than 70 securities and FX firms, publication of information and ransomware attacks on customers' computers. Ransomware is malicious software that can lock files to demand payment. No ransomware attack had been confirmed as of 1:55 p.m. Japan time on October 27.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
GMO counts 26,739 servers as potentially affected, rather than as confirmed break-ins or data thefts. Anything customers stored on those servers may have been viewed, including trading-software login details. The company does not keep customers' payment-card data on the servers. As of October 28, GMO had not said how the attackers entered or confirmed how much information had been published.
Broker OANDA Japan confirmed third-party logins and trades on some customer accounts using usernames and passwords it believes leaked from GMO’s servers. It restricted trading on potentially affected accounts. As of October 26, it had found no intrusion or leak in its own core systems.
Broker FXTF warned on October 22 that some customers' login details may have been stolen from another company’s hosted servers and used to access accounts or trade. It told customers who had connected to Desktop Cloud to change their FXTF passwords from a device that had never connected to the service.
GMO also asks customers to end all trading-account sessions, check balances and trading histories, report unfamiliar trades to their broker and enable two-factor authentication where available. That adds another identity check to the password. Customers should also change reused passwords and scan devices that connected to Desktop Cloud.
A tip earns payment only if it helps lead to an arrest, including outside Japan, or an international wanted notice. GMO decides how much each tip contributed. One contributor could receive the full $1 million, several could share it, or no money would be paid if no tip qualifies.
The programme seeks evidence linking people, servers, domains, internet addresses, accounts or cryptocurrency addresses to the attack, extortion or movement of money, as well as evidence of how the crimes were carried out. Guesses, unsupported accusations and reposts of public information generally do not qualify.
Contributors can email tips in Japanese, English or Chinese to the address listed on the programme’s dedicated website. Anonymous submissions are allowed, but contributors must prove their identity before receiving payment. People involved in the crime, people who obtained information illegally—including by buying leaked data—and GMO staff cannot be paid.
GMO prohibits contributors from breaking into systems, negotiating with or paying the attackers, or sending leaked data, login credentials or malware. It says it will never ask tipsters for passwords, authentication codes or fees, and will contact them only from addresses ending in @cybercrimebounty.gmo.
The group says tips will be shared with police and other authorities in Japan and abroad as needed. GMO Internet has already submitted all its evidence about the threats, including communication records, to police. The bounty closes upon an arrest or international wanted notice, or on October 27, 2027, whichever comes first.
GMO Internet says it will seek immediate takedowns if replacement sites appear. It asks people not to visit the attackers' sites, link to them or repost their contents. GMO says the attackers collected information about visitors and advises anyone who visited to run a full antivirus scan.
In its October 24 notice, GMO Internet said it would not restart the compromised infrastructure unchanged, citing customer safety and a decision to redesign its security architecture. Current Desktop Cloud customers who still want a Windows desktop will be offered a move to an alternative service on separate cloud infrastructure, free for six months after migration. No customer will be moved without consent.
Before customers apply, GMO promises to explain differences in functions and use, migration precautions, what the free period covers, and prices and contract terms after it ends.
By 11:59 p.m. Japan time on October 30, GMO Internet says it will email customers the alternative service’s start date and application process. The email will also explain how contracts and charges will be handled for customers who decline to migrate.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
