GMO Puts a $1 Million Bounty on Its Hackers After Refusing to Pay Ransom

When criminals breach a company and demand a ransom, most victims face a grim choice: pay up and hope the data disappears, or refuse and brace for leaks. Japan's GMO Internet Group has chosen a third option this week: turn the tables and pay people who help catch the attackers instead.

On October 28, the Japanese internet and fintech giant officially opened a bounty program offering up to US$1 million (roughly 160 million yen) in total rewards for lawfully obtained information that leads to the arrest of — or an international wanted notice for — the perpetrator of the breach of its Onamae.com Desktop Cloud service. The company is seeking tips that connect people, servers, domains, IP addresses, accounts, or cryptocurrency wallets to the attack, the extortion attempt, or the movement of stolen funds.

From cloud desktops to live trading accounts

The incident at the heart of the bounty is unusual in how far the damage reached. Onamae.com Desktop Cloud rents out Windows cloud desktops that traders commonly use to run automated foreign exchange (FX) trading software around the clock. That means the servers didn't just hold customer records — in many cases they held live credentials to brokerage accounts.

GMO first disclosed unauthorized access to the service on October 21, shut the service down the same day, and reported the matter to Japanese police on October 22. Attackers allegedly used trading credentials stored on the rented servers to place unauthorized orders at brokerages, turning a routine-sounding data breach into real-time financial fraud. GMO estimates that around 27,000 servers across all plans could have been at risk, though the company stresses this is the number of potentially affected machines, not a confirmed count of compromised ones.

A ransom demand, and a hard no

According to reporting by TechCrunch and others, the attackers initially emailed GMO on October 21 demanding roughly $50 million (about 8 billion yen). Later statements attributed to the attacker demanded US$1 million with a deadline of noon JST on October 27, threatening to manipulate trading accounts at more than 70 securities and FX firms in Japan and abroad, publish customer information daily at noon, launch ransomware attacks against users' machines, and expose details of GMO's own internal systems.

GMO's response has been unequivocal. The company says it handed all communications with the extortionists over to police cybercrime units and publicly declared it will never give in to the demands. "We are seeking credible information that leads to the identification and arrest of those involved," the company stated on its dedicated bounty portal, which accepts submissions in Japanese, English, and Chinese.

After the deadline passed, material purporting to contain customer personal information began appearing online, and a suspected attacker published what appears to be at least one customer's name and phone number. GMO confirmed on October 27 that information connected to the company and its customers had been published, and on October 28 announced that the domain used for the extortion site had been taken down — while warning that replacement sites could still emerge.

Making customers whole

Alongside the bounty, GMO has moved to compensate affected users. In an October 28 stock exchange filing, the company said it will pay every current user of the service 5,000 yen and cover actual trading losses and fees for any trades it confirms were unauthorized and caused by the breach. It cautioned that it has not yet confirmed how many customers the compensation program will cover, how much information was published, or which trades qualify.

The company has also been collecting customers' devices since October 25 to check for malware, and has urged users to reset passwords for any trading or financial accounts used from the service. Its group CEO wrote in a blog post that internal security researchers had flagged problems with the service before the attack, and that fixes were underway but not deep or fast enough.

Why this case matters

The GMO incident lands in the middle of what some security experts have taken to calling AI's "Black October" — a stretch marked by a sharp rise in AI-accelerated vulnerabilities and attacks. Whatever tools the attackers used, the case highlights a structural risk that is only growing: cloud services that hold live financial credentials turn a single intrusion into direct monetary theft. A breached marketing database is a liability; a breached trading desktop is a loaded weapon.

It also illustrates a shifting stance on extortion. Companies like Kraken have publicly refused ransom demands before, but putting a formal bounty on the attackers' heads — funded at $1 million, coordinated with police, and open to tips worldwide — is a more aggressive posture. Cyber insurance premiums and regulation increasingly discourage paying ransoms, since payment funds future attacks and offers no guarantee data is deleted. Bounty programs flip the incentive: instead of paying criminals, pay the ecosystem that can unmask them.

There are risks to this approach too. Attackers may escalate leaks to punish defiance, and bounties rarely produce arrests when attackers operate from safe jurisdictions. But as a signal of where enterprise incident response may be heading, GMO's move is one of the clearest yet: don't fund the attack — fund the manhunt.

For now, GMO says it will continue working with law enforcement, compensating customers, and pursuing takedowns of any replacement leak sites. The bounty program remains open, and the investigation is ongoing.