GMO offers up to $1m for tips after Onamae.com Desktop Cloud breach as leak site goes down

In brief

Drafted with AI assistance and reviewed by the editor. Developing.

GMO Internet says the domain of the site where attackers published what they claimed was customer information from its Onamae.com Desktop Cloud service was suspended at around 4:00 a.m. JST on 28 October. The company reported this in its thirteenth report on the incident. The service hosts Windows desktops used for FX trading, according to The Hacker News.

What is known

According to GMO's timeline, it suspended the service on 21 October and received a threatening email demanding approximately ¥8bn. GMO says it will not pay. The Hacker News reports that GMO counts 26,739 servers as potentially affected, which is not a count of confirmed break-ins. It also reports that anything customers stored on the servers may have been viewed, including logins saved in MT4/MT5 trading software, but not payment card data. In a stock exchange filing on 28 October, GMO said it had not yet confirmed how many customers its compensation payments will cover, and it has not said how the attackers got in, The Hacker News reports.

The reward

GMO's "GMO Cybercrime Bounty" has a total cap of USD 1m, and tips have been accepted since 12:00 JST on 28 October, according to its twelfth report. The Hacker News reports that it pays only if a tip helps lead to an arrest or an international wanted notice. The program runs until either happens or until 27 October 2027, and one tipster can receive the full amount or it can be split. GMO says the reward is not a ransom or payment for stolen data.

What GMO tells customers

GMO asks people not to access the leak site or spread its contents. Anyone who visited it should run a full antivirus scan. GMO says it never asks for passwords or authentication codes, and it runs a 24-hour helpline (+81-3-5456-2560). According to The Hacker News, GMO also advises customers to change trading passwords from a device not used for FX trading and to turn on two-factor authentication.

Sources and scope

• GMO Internet, thirteenth report (28 Oct, as of 11:00 JST): https://internet.gmo/en/news/article/259
• GMO Internet, twelfth report (27 Oct): https://internet.gmo/en/news/article/258
• The Hacker News (28 Oct): https://thehackernews.com/2026/10/japans-gmo-offers-1-million-bounty-to.html

The server count, data types and password advice come from The Hacker News and were not checked against GMO's earlier reports. This ByteNib editorial analysis does not link to or describe the leak site.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: IT Leadership analysis, the related implementation tutorial, and the structured learning path.