Japan’s GMO Internet Group has announced a reward program offering up to $1 million for information that leads to the capture of those responsible for breaching its Onamae.com Desktop Cloud service. This initiative follows their decision to decline an extortion demand from the attackers.
Details of the Reward Program
Launched on October 28, the GMO Cybercrime Bounty is designed to incentivize tips that result in an arrest or an international wanted notice. The compromised service hosts Windows desktops utilized for foreign exchange (FX) trading, and unauthorized trades have been linked to leaked logins from the service. GMO reports that sensitive customer data was compromised during the breach.
The reward will be distributed based on the significance of the information provided, with the possibility of one individual receiving the full bounty or the amount being divided among multiple contributors. Tips must be submitted via email in Japanese, English, or Chinese, and anonymity is permitted. The program remains open until an arrest, a wanted notice is issued, or October 27, 2027, whichever comes first.
Impact of the Breach
The breach was discovered on October 20, when it was revealed that malicious software had been installed on some customers’ servers. GMO responded by shutting down affected servers, which may number up to 26,739, though not all are confirmed to have been compromised. Customers reported suspicious trades starting October 21, and further investigations linked these to leaked login credentials.
GMO is actively working with authorities and has shared all gathered evidence, including communication logs, with police. They have assured that no payment card data was stored on the compromised servers.
Security Measures and Advice for Customers
GMO has advised customers to take several precautions, including changing trading-account passwords from devices not used for FX trading and enabling two-factor authentication where possible. They also suggest running antivirus scans and backing up important data. Customers have been warned against engaging with any messages or links from the attackers.
In an effort to compensate affected users, GMO will provide ¥5,000 to all current customers and reimburse verified unauthorized trading losses. For those whose data was exposed, additional compensation between ¥10,000 and ¥25,000 will be provided.
As the investigation continues, customers are urged to remain vigilant and follow recommended security protocols to protect their accounts and information.
