Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach

GMO Internet Group says attackers breached its Onamae.com Desktop Cloud service, installed malicious programs on some customer servers, accessed the service, and took customer information. The Windows desktops hosted there were used for activities including foreign-exchange trading. GMO shut down servers on every plan after finding the attack and refused an extortion demand of about $50 million.

The company launched GMO Cybercrime Bounty on October 28. It will pay up to $1 million in total for information connecting people, servers, domains, IP addresses, accounts, or cryptocurrency addresses to the attack, extortion, or money movement. A tip must help produce an arrest or an international wanted notice.

The reward aims to generate evidence that can identify and prosecute the attackers. GMO says customer information was posted on an attacker-controlled website, while customers faced threats involving account manipulation, ransomware, and further leaks. The program remains open until an arrest, wanted notice, or October 27, 2027.

A cloud-hosted desktop is a remotely operated computer provided through an online service. The provider runs the Windows system on its own servers, while the customer views and controls the desktop from another device. This lets users access the same workspace without keeping the computer physically nearby.

For foreign-exchange trading, a customer can install or use trading software on that Windows desktop. The article specifically names MetaTrader 4 and MetaTrader 5. Login credentials may be saved inside the software, allowing the desktop to connect to a broker and support trading activity.

That convenience also creates risk when the hosted system is breached. GMO says anything stored on affected servers may have been viewed, including trading credentials. OANDA Japan linked unauthorized logins and trades on some customer accounts to ID and password pairs it believes came from GMO servers. The incident shows why a remote trading computer must be protected like a valuable account gateway.

The possible reach was substantial. GMO counted 26,739 servers as potentially affected after malicious programs were found on some customers’ servers. That number is a precautionary scope, not a confirmed count of compromised servers or cases involving stolen data. GMO had confirmed unauthorized service access and exfiltration of customer information.

The financial demands point in opposite directions. The attackers sought about $50 million, or roughly ¥8 billion, from GMO on October 21. GMO refused to pay. Instead, it created a bounty worth up to $1 million for information that leads to an arrest or an international wanted notice.

The reward is about 2% of the demand, making the extortion request approximately 50 times larger. It is not compensation for affected customers. GMO had not yet confirmed which customers its payments might cover, how much information was published, or which unauthorized trades could qualify for compensation. The potential impact therefore remained under investigation.

A cloud desktop can hold the software, saved passwords, and account details needed to connect to a broker. If attackers obtain those credentials, they may be able to present themselves as the customer. They can then use the broker’s normal login process rather than breaking into the broker’s core systems.

The article gives a direct example. OANDA Japan said a third party logged in to and traded on some customers’ accounts using ID and password pairs it believed were leaked from GMO servers. Customers began reporting unrecognized trades on October 21. OANDA restricted trading on accounts that might be affected and had not found a break-in or leak in its own core systems as of October 26.

This means the cloud service could become the entry point while the trading broker remains uncompromised. FXTF also warned that stolen VPS-related logins might be used for trading. Changing passwords from a device that never connected to Desktop Cloud was among its instructions to customers.

GMO wants more than a name or suspicion. A useful tip may connect people, servers, domains, IP addresses, accounts, or cryptocurrency addresses to the attack, the extortion effort, or movement of money. It should also include evidence showing how the crimes were carried out. Guesses, unsupported accusations, and reposts of public information generally do not qualify.

Payment depends on a concrete law-enforcement result. The information must help lead to an arrest, including an arrest outside Japan, or an international wanted notice such as an Interpol Red Notice. GMO decides how much each tip contributed. One person may receive the entire $1 million, or the amount may be divided among tipsters.

This condition focuses the program on information authorities can act on and helps limit false reports. Tipsters must verify their identities before payment. People involved in the crime or who obtained information illegally cannot be paid. GMO shares tips with police and other authorities as needed.

Several protections could have reduced the damage, although the article does not say whether customers used them. Separate administrator accounts would limit everyday users’ ability to change system settings or install programs. Multi-factor authentication could require an additional approval beyond a stolen password. Keeping trading credentials off shared cloud desktops would remove one especially valuable target.

The incident shows why these controls matter. GMO says anything stored on affected servers may have been viewed, including credentials saved in MetaTrader 4 and 5. If passwords were unavailable there, attackers might have had more difficulty entering broker accounts. If a second authentication factor were required, a password alone might not have been enough.

These measures would not guarantee safety. Customers would still need to isolate affected devices, change passwords from clean systems, restrict trading access, and monitor accounts. Brokers could also apply tighter restrictions or alerts. OANDA Japan restricted potentially affected accounts, while FXTF told customers to change passwords from devices that had never connected to Desktop Cloud.

Ransomware is malicious software used to deny access to systems or data, often by encrypting or disrupting them. Data exfiltration is the unauthorized removal of information from a system. Extortion is a demand for money backed by a threat, such as publishing stolen data or causing further harm.

These tactics can reinforce one another. Attackers may first enter a service, copy customer information, and obtain credentials. They can then threaten to publish the data, manipulate accounts, or deploy ransomware unless the victim pays. GMO says attackers demanded about $50 million and threatened customers’ trading accounts and data. They also threatened ransomware attacks against customers’ PCs.

GMO confirmed unauthorized access and exfiltration of customer information, but no ransomware attack had been confirmed as of 1:55 p.m. Japan time on October 27. The attackers posted material they called one customer’s personal information. GMO shut down the attackers’ website and said it would act against new sites.