GMO launches $1 million bounty after Desktop Cloud breach
Japan’s GMO Internet Group has launched a reward programme worth up to $1 million for information that helps identify attackers behind a breach of its Onamae.com Desktop Cloud service. The Windows desktop service is used for FX trading, and GMO says attackers exfiltrated customer information after malicious programs were installed on some customer servers.
The GMO Cybercrime Bounty opened on October 28 after the company refused an extortion demand of roughly $50 million, or about ¥8 billion. A payment is available only where a tip leads to an arrest, including one outside Japan, or to an international wanted notice such as an Interpol Red Notice.
Potential exposure reaches 26,739 servers
GMO Internet, the subsidiary operating Desktop Cloud, said it detected the malicious programs on October 20 and shut down servers across every plan the following day. It counts 26,739 servers as potentially affected, while stressing that this figure is not a count of confirmed intrusions or confirmed data theft.
On October 24, the company confirmed a security issue in the service, unauthorised access and the exfiltration of customer information. Data stored on affected servers may have been viewed, including credentials saved in trading applications such as MetaTrader 4 and MetaTrader 5. GMO says payment-card data is not retained on those servers.
Customers began reporting unrecognised trades on October 21. OANDA Japan has confirmed that a third party accessed and traded on some customer accounts using ID and password combinations it believes were leaked from GMO servers. The broker restricted trading on potentially affected accounts and, as of October 26, said it had found no breach or data leak in its own core systems.
Reward rules focus on evidence, not public claims
GMO is seeking evidence that links people, infrastructure, domains, IP addresses, accounts or cryptocurrency addresses to the breach, extortion or movement of funds. Tips may be submitted anonymously in Japanese, English or Chinese, but unsupported allegations, guesses and reposted public information will generally not qualify.
The company can award the entire amount to one informant or divide it among several, based on the contribution each tip made. Recipients must verify their identity before payment. Participants involved in the crime, those who acquired information unlawfully, including by purchasing leaked data, and GMO employees are excluded.
GMO has also warned tipsters not to access systems, contact or pay the attackers, submit leaked data or credentials, or provide malware. The company says it will share relevant reports with law-enforcement authorities in Japan and abroad and has already submitted its records of the threats to police.
Trading customers are urged to reset access safely
The attackers threatened to manipulate accounts at more than 70 securities and FX firms, publish information about customers and GMO systems, and deploy ransomware against customer PCs. GMO said it had not confirmed a ransomware attack as of 1:55 p.m. Japan time on October 27. It also asked people not to visit or redistribute material posted by the attackers, noting that the site collected information about visitors.
GMO has instructed Desktop Cloud users to change trading and trading-software passwords from a device not used for FX trading, end all active sessions, examine balances and trading histories, and enable two-factor authentication where available. It also advises changing reused passwords, scanning devices fully for malware, backing up data and ignoring attacker messages or fee-based recovery offers.
The group will pay every current user ¥5,000 and says it will cover confirmed unauthorised trading losses and related fees caused by the breach. It will not restart Desktop Cloud on the compromised systems; customers seeking a Windows desktop will be offered a consent-based migration to another service, free for six months. For organisations using hosted desktops for financial activity, the immediate business implication is to treat saved credentials and active sessions as exposed, reset access from clean devices and coordinate promptly with brokers and incident-response teams.