GMO Internet Group: $50 Million Ransom Demand After Onamae.com Desktop Cloud Breach

Japan's GMO Internet Group confirmed on October 24, 2026 that attackers exfiltrated customer information from its Onamae.com Desktop Cloud service, demanded roughly $50 million (about ¥8 billion), and threatened ransomware on up to 26,739 customer servers, prompting the company to refuse payment and instead launch a $1 million cybercrime bounty program on October 28, according to The Hacker News.

What was the specific vulnerability?

The specific vulnerability has not been identified: as of October 28, 2026, GMO said in a stock exchange filing that it had not yet confirmed how the attackers got in. What the company has confirmed is the sequence of what the intruders did. According to BleepingComputer, GMO Internet, the subsidiary running the service, detected on October 20 that a third party had installed malicious programs on some customers' servers. On October 24, GMO confirmed unauthorized access to the service and exfiltration of customer information, stating that anything stored on the servers may have been viewed, including MetaTrader 4/5 (MT4/MT5) trading credentials. GMO says it does not keep customers' payment card data on the affected servers. Onamae.com Desktop Cloud is a Windows-desktop VPS service widely used for foreign exchange trading, which is why trading credentials were stored on the machines.

How was the incident detected?

The incident was detected internally by GMO Internet on October 20, 2026, when it found malicious programs installed on some customer servers. The extortion demand arrived the next day: on October 21, attackers demanded about $50 million and threatened to manipulate customers' accounts at more than 70 securities and FX firms, publish customer and system information, and hit customers' PCs with ransomware, setting noon on October 27 as the deadline. GMO shut down servers on every plan starting October 21. On October 24 it confirmed the data exfiltration. On October 27, the attackers posted material they said was a customer's personal information on their own website; that site, including mirror sites, was shut down at about 4 a.m. Japan time on October 28, and GMO says it plans to act against any new site. GMO warns that the leak site collected information on visitors and tells them to run a full antivirus scan. BleepingComputer reports that the attacker never activated the ransomware, and no ransomware attack had been confirmed as of 1:55 p.m. Japan time on October 27.

What is the current impact?

The current impact reaches up to 26,739 customer servers, which GMO counts as potentially affected rather than confirmed break-ins, plus confirmed data theft and unauthorized trading at downstream brokers. Broker OANDA Japan confirmed that a third party logged in to and traded on some of its customers' accounts using ID/password pairs it believes were leaked from the GMO servers; it restricted trading on possibly affected accounts and, as of October 26, had found no break-in or leak in its own core systems. Broker FXTF warned on October 22 that third parties may have stolen logins of some customers using VPS servers and urged password resets from a never-before-used device. Customers were told on October 27 to disconnect their PCs from the internet, power them down, and unplug cables. GMO is scanning systems for residual malware and offering PC replacements to ransomware victims. The company refused the ransom and is offering each customer ¥5,000 (about $30) in compensation for inconvenience, with additional compensation under consideration for those whose data was exposed. It has also said it will take legal action against anyone disseminating the leaked data.

What are the next steps?

The next steps are GMO's bounty program, its compensation process, and an unfinished internal investigation. On October 28, 2026, GMO launched the "GMO Cybercrime Bounty," offering up to $1 million total for tips leading to an arrest or an international wanted notice, such as an Interpol Red Notice. The program runs until an arrest, a wanted notice, or October 27, 2027, whichever comes first. Tips can be anonymous, submitted in Japanese, English, or Chinese, and one tipster can receive the full $1 million or the total can be split. Masatoshi Kumagai, who heads GMO Internet Group, wrote in an October 25 blog post that the group's own white-hat hackers had warned the service's team about problems in advance, and that "the response was neither fast nor thorough enough." In its October 28 filing, GMO said it had not yet confirmed how many customers its payments will cover, how much information was published, which trades qualify for compensation, or the initial access vector.

By the numbers

Source snapshot