GMO Internet Group has opened a reward program worth up to $1 million for information leading to arrests over the intrusion into its Onamae.com Desktop Cloud service, after declining to pay the attackers.
GMO Cybercrime Bounty launched October 28 and runs until an arrest, an international wanted notice, or October 27, 2027. Tips can be anonymous, in Japanese, English or Chinese, but money is released only after an arrest or an Interpol-level notice.
The company received a demand of roughly $50 million, about 8 billion yen, on October 21. It refused, arguing that complying would not guarantee the data was deleted or its misuse prevented.
FX accounts traded without their owners
The service hosts Windows desktops GMO recommends for FX trading, which turned a hosting compromise into a financial one. Customers began reporting unrecognized trades on October 21. Broker OANDA Japan confirmed a third party traded on client accounts using credential pairs it believes came from the GMO servers.
GMO shut the servers across every plan and counts 26,739 as potentially affected, a figure it stresses is not a count of confirmed intrusions. Anything stored there, including MetaTrader 4 and 5 logins, may have been viewed.
The attackers threatened to keep manipulating accounts at more than 70 securities and FX firms, publish customer machine details and deploy ransomware. Material went up on October 27; the domain and its mirrors were shut down the next morning.
The admission that matters
Chief executive Masatoshi Kumagai acknowledged that GMO’s white-hat hackers had flagged weaknesses and remediation was too slow. “Our response lacked sufficient depth and speed,” he wrote, adding that the group will fund a free replacement environment for six months and rebuild the infrastructure.
Customers are being offered a 5,000 yen consolation payment and reimbursement of trading losses caused by the breach.
