Japan’s GMO Internet Group has refused a $50 million cryptocurrency ransom linked to a cyberattack on its Onamae.com Desktop Cloud service, while offering up to $1 million for information that helps identify the attackers. The company confirmed that people believed to be responsible published material purporting to contain customer information on October 27, before the associated website domain was taken down early on October 28.
The latest developments turn an already serious breach of infrastructure used by foreign-exchange traders into a continuing extortion and customer-remediation case. GMO has confirmed unauthorized access and theft of information from the service environment, but the published data remains under verification, and an examination of customers’ devices had not confirmed ransomware infection as of its October 28 evening update.
The original $50 million demand specified payment in Bitcoin or Ethereum, according to a ransom document disclosed by GMO Group chairman and president Masatoshi Kumagai. A separate, later $1 million demand was reported by Japanese media, while GMO’s identically sized $1 million bounty is an entirely different payment: a reward for lawful evidence, not money paid to the attackers.
How Did the $50 Million Bitcoin and Ethereum Demand Emerge?
In an account published on his official website, Kumagai said the attackers sought $50 million, approximately ¥8 billion at the contemporary conversion used in reports. He said GMO received the demand at 11:57 a.m. Japan time on October 21 and had not complied or paid anything. Japanese reporting on the disclosed demand said it specified BTC or ETH and required payment by 5 p.m. that day.
The attackers also allegedly threatened further unauthorized trading in customer accounts, release of internal information and customer data, and ransomware attacks against computers connected to the service. These threats were not proof that all intended actions had occurred or that every broker mentioned in the message was infiltrated.
Fuji Television reported a second demand conveyed by people claiming responsibility for the attack: approximately $1 million, with a deadline of noon on October 27, citing cybersecurity firm S&J. The reported figure is 98% below $50 million, although the publicly available details do not independently establish that precisely the same group sent both demands or that a mutually authenticated negotiation took place. It is safer to describe this as a later reported demand than a confirmed renegotiation.
Japanese crypto publication NADA NEWS reported on October 28 that the demand specified Bitcoin and Ethereum and reiterated GMO’s refusal to pay. Choosing cryptocurrency as a requested settlement method does not establish any on-chain payment. No verified attacker-receiving wallet or ransom transaction proving a transfer by GMO has been identified in the disclosures reviewed.
What Happened After the October 27 Threat Deadline?
At 12:30 p.m. Japan time on October 27, GMO confirmed that people it believed were the attackers had published material they claimed concerned the company and its customers. Its tenth security update said the content had not yet been fully verified and could include inaccurate information. The distinction matters: publication of attacker-supplied files is established, but the accuracy of each field and the population actually exposed are not.
On October 28, GMO announced that the domain of the website used to display the purported information had been disabled at approximately 4 a.m. local time after cooperation with relevant providers. A domain takedown restricts an outlet for distribution; it does not automatically erase files already copied by the attackers or other parties, or establish that the underlying breach is contained.
Its fourteenth update, current to 6:20 p.m. Japan time on October 28, reported that its forensic review of customer devices submitted for examination had not found evidence of malware infection or ransomware attacks in those tested systems. The review remained incomplete. That result should not be read as proof that no malicious program had ever been deployed in the cloud-hosting environment: earlier disclosures described malicious software in some server environments.
GMO also launched a public information-reward program at noon on October 28, offering an aggregate maximum of $1 million for verifiable information that helps identify, arrest or investigate those involved. Within six hours, the company had received 113 submissions. The reward is funded by GMO Internet Group and does not involve paying the people threatening the company.
The group reiterated that it would not satisfy the attackers’ demands, arguing that payment could neither guarantee deletion of copied information nor prevent future misuse. It has involved Japanese police, requested assistance from government authorities and urged people not to visit or reproduce the perpetrators’ data-leak website, warning of potential secondary exposure.
What Does the 26,739-Server Exposure Mean for FX Traders?
The intrusion originated at Onamae.com Desktop Cloud, a hosted remote-computer service supplied by listed GMO Internet, Inc. (securities code 4784), within the wider GMO group. The product is used by foreign-exchange traders to keep MetaTrader terminals and automated strategies running on rented infrastructure. The group parent is a separate listed entity, GMO Internet Group (9449); disclosures should not conflate the two legal companies.
GMO identified up to 26,739 server environments as potentially affected. That is the number within the possible exposure scope, not a count of infected machines, compromised brokerage accounts, distinct traders, confirmed victims or completed unauthorized trades. The company began investigating customer inquiries on October 19, identified malicious programs in some environments on October 20 and began shutting down all service plans at 4 a.m. Japan time on October 21.
Its October 24 disclosure acknowledged that customer information had been removed from the affected service environment and that some users reported trading-account activity they did not recognize. The attackers threatened activity involving accounts held at more than 70 domestic and international securities and FX firms. That figure describes the potential reach of customer connections and the threats, not evidence that 70-plus brokers’ internal systems were hacked.
Individual broker responses show why this layer of infrastructure matters. DaveFinances previously reported that OANDA Securities Japan delayed certain withdrawal batches for security checks after the provider breach. Such a precaution did not establish missing customer funds or a global OANDA outage.
Separately, AvaTrade Japan acknowledged unauthorized trading in some accounts linked to third-party service usage, without asserting that every affected account could be traced to GMO or that AvaTrade’s own infrastructure was compromised. One Japanese customer also reported approximately ¥1.8 million in trading losses after transactions she did not authorize. These cases illustrate different levels of evidence: a protective payment delay, a broker’s confirmed unauthorized trades and an individual’s reported financial loss.
Trading credentials stored on a remote desktop can permit someone to open or close positions when they are compromised. They do not necessarily grant access to the broker’s banking withdrawal process, which may use additional authentication. But leveraged trades can create realized losses without an attacker ever moving a cash balance to an external bank account.
How Much Will GMO’s Compensation and $1 Million Bounty Cost?
The October 24 compensation announcement offered a ¥5,000 goodwill payment to every current Desktop Cloud customer, regardless of demonstrated financial loss. GMO separately pledged to reimburse realized trading losses and related fees that its investigation confirms arose from unauthorized transactions caused by this incident. Ordinary market losses, hypothetical profits and indirect damage are excluded from that stated commitment.
On October 27, the group added special goodwill payments for customers whose information was verified as published. The announced categories are ¥10,000 for basic identifying and contact details, ¥15,000 for financial or authentication information, and ¥25,000 for sensitive personal information. Categories can be combined if several apply, subject to the company’s specified per-publication ceiling of ¥3 million. Those payments are separate from the universal ¥5,000 payment and approved trading-loss reimbursement.
| Amount | Who receives or seeks it? | What it represents |
|---|---|---|
| $50 million | Demanded by suspected attackers | Original ransom; GMO says unpaid |
| $1 million | Later demand attributed to attackers in media reports | Reported revised extortion demand, not a confirmed payment |
| Up to $1 million | Eligible information providers | GMO’s total cybercrime-investigation reward pool |
| ¥5,000 per current customer | Current Desktop Cloud users | Flat goodwill payment |
| ¥10,000 / ¥15,000 / ¥25,000 | Customers with verified exposure of corresponding data categories | Additional goodwill payments, subject to policy limits |
| Eligible realized trading losses | Customers whose qualifying unauthorized trades are confirmed | Separate case-by-case compensation |
These figures cannot be totaled into a responsible estimate of GMO’s final liability. The company has not published the number of distinct eligible customers, verified leaked records or aggregate realized trading losses. Multiplying ¥5,000 by 26,739 would be an invalid calculation because the latter figure counts potentially affected servers rather than individual customers entitled to payment.
GMO has also offered affected customers access to alternative cloud arrangements for six months without charge, creating additional service and remediation costs beyond direct compensation. The final financial burden will depend on claims substantiation, rebuilding and investigation expenses, customer retention and how quickly a secure operating environment becomes available.
Does the Ransom Refusal Limit the Financial Damage?
Refusing an extortion demand avoids a direct transfer to the attackers, but it does not eliminate customer losses, data-exposure obligations or operational disruption. Conversely, paying would not prove that stolen data was deleted or that the attacker’s ability to issue threats had disappeared. This helps explain GMO’s decision to devote money to investigations and customer support instead.
There is a governance issue as well. In his statement, Kumagai said internal security specialists had previously identified areas requiring improvement in the service, but that remediation had not proceeded deeply or quickly enough given competing service-availability priorities. That is an unusually consequential admission: an incident-response budget is only one part of resilience if earlier technical warnings were not fully translated into timely control changes.
The cryptocurrency component of this story should also be kept in proportion. Attackers requested BTC or ETH as payment; that is not evidence of a cryptocurrency exchange breach. GMO Coin, the group’s digital-asset trading subsidiary, said on October 26 that the intrusion occurred at a separate service and that it had not identified unauthorized activity in its own customer accounts related to this event. Its cautionary notice advised users to check their trading history, passkeys and API credentials.
For investors and customers, the next material disclosures are the number of confirmed affected users, the authenticity and extent of published data, verified trading losses, the cause and duration of the intrusion, and progress toward restoring the service. The attackers’ public website may be down, but that is not the same as recovering confidential information. The $50 million demand was refused; the economic cost of the incident remains to be measured.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574