GMO cloud breach: $1 million bounty, account checks

GMO refused a roughly $50 million extortion demand after a cloud breach in which attackers stole customer data from Onamae.com Desktop Cloud. The company's response includes a bounty of up to $1 million total for tips that lead to an arrest or an international wanted notice. Customers need to change trading credentials, kill active sessions, and check for unauthorised trades.

According to The Hacker News report, OANDA Japan confirmed third-party logins and trades using credentials it believes leaked from GMO's servers. For customers running trading software on these Windows desktops, the problem extends beyond losing access to a hosted machine: their brokerage accounts need attention too.

Secure trading accounts after the cloud breach

GMO's October 23 Notice Regarding Unauthorized Access to a Service Provided already demanded credential changes, session termination, and account checks. The follow-up advice reported by The Hacker News adds precautions for connected devices and reused passwords.

1. Change passwords for trading accounts and trading software from a device not used for FX trading — a phone, for instance. FXTF specifically told affected customers to use a device that had never connected to Desktop Cloud.
2. End all active login sessions, even after changing passwords. Ask the broker to terminate them if necessary.
3. Review trading history and account balances. Report transactions you don't recognise to the broker first.
4. Enable two-factor authentication wherever the broker supports it.
5. Change passwords reused on other services, including passwords saved in the browser.
6. Run a full antivirus scan on devices used to connect to Desktop Cloud, and back up their data.

What GMO confirmed about Desktop Cloud

GMO started investigating after a customer inquiry on October 19, 2026. It found an unauthorised program in some customer server environments on October 20 and suspended server operations across every plan from October 21.

Its October 23 disclosure identified 26,739 potentially affected servers. That's an investigation boundary, not a count of confirmed intrusions, stolen records, or affected customers. Information customers stored on those servers fell within the potential exposure scope.

By October 24, GMO said it had confirmed a security problem, unauthorised access, and customer-information exfiltration. Trading credentials stored in tools such as MetaTrader 4 and 5 may have been accessible. OANDA Japan said that, as of October 26, it had found no intrusion or leak in its own core systems.

The $1 million bounty pays for results, not submissions

GMO's twelfth incident report established the bounty framework.

The Hacker News reports the programme opened on October 28 and gives a fuller closing rule than the launch table: an arrest, an international wanted notice, or October 27, 2027, whichever comes first. Payment requires a tip that helps produce an arrest or international wanted notice; submitting useful-looking material doesn't automatically earn money.

GMO wants evidence connecting participants to infrastructure, accounts, cryptocurrency addresses, money movements, or the conduct of the attack. Unsupported accusations and copies of public reporting generally don't qualify. The company decides each contribution's value and can split the total between contributors.

GMO prohibits breaking into accounts, buying leaked information, negotiating with attackers, or paying them. Don't send leaked credentials or malware. If you lawfully hold sensitive evidence, describe it first and wait for safe submission instructions.

GMO confirms suspension of the attackers' site domain

In its thirteenth incident report, GMO says the attackers' site domain, including mirror sites, was suspended around 4 a.m. Japan time on October 28. It says it will seek takedowns if replacement sites appear.

Don't visit a mirror to check whether your information is there. GMO says the attackers collected information about visitors and advises anyone who visited to run a full antivirus scan. It also asks people not to repost the material or share links directing others to it.

Treat unsolicited messages about this cloud breach cautiously. Don't open links or attachments from claimed attackers, and reject fee-based offers to recover lost money. GMO says it will not ask customers for passwords or authentication codes.

The entry point and customer-PC compromise remain unconfirmed

As of October 28, GMO had not publicly explained how the attackers entered. The Hacker News reports that group head Masatoshi Kumagai acknowledged earlier warnings from the group's white-hat hackers and said the response hadn't been sufficiently fast or thorough. That acknowledgement doesn't establish the technical attack path.

The attackers claimed that servers shared an administrator account, connected customers' PC drives were visible by default, and a service flaw let them reach those PCs. GMO had not publicly confirmed those claims.

GMO reported no malware, including ransomware, on the customer PCs it had finished examining by 11:59 a.m. Japan time on October 27. The analysis was still underway. Separately, no ransomware attack had been confirmed as of 1:55 p.m. that day, despite the attackers' threat.

Those dated, partial results do not clear every connected device; they support neither a blanket claim of infection nor a blanket assurance of safety, and the sources provide no confirmed entry-point fix or technical verification command.

Desktop Cloud payments and the planned replacement

GMO says it will pay every current user ¥5,000 and cover actual losses and fees from trades it confirms were unauthorised and caused by the cloud breach. Additional payments depend on GMO confirming that a customer's information was published.

The twelfth report sets out these information-disclosure payments.

Applicable categories are added together, subject to the report's ¥3 million cap per disclosure. These payments are separate from the ¥5,000 payment and compensation for unauthorised trading losses. As of October 28, GMO had not confirmed the full customer coverage, publication scope, or qualifying trades.

For continuity, GMO says it will offer consenting customers a move to a separate Windows-desktop service, free for six months. It will not restart the breached systems as they are. Details were due by October 30; the supplied sources don't establish that the replacement is available.

I'd separate account recovery from the migration decision: secure the broker accounts now, then assess the replacement when its details arrive.