GMO Cloud Breach: $1 Million Bounty, $50M Ransom Refused and What FX Traders Must Do
GMO cloud breach explained: what happened to Onamae.com Desktop Cloud, how leaked MT4/MT5 logins became unauthorized trades, the $1 million bounty and who gets paid.
The GMO cloud breach is one of Japan's most serious cyber incidents of 2026. Attackers broke into Onamae.com Desktop Cloud, a Windows server service used by forex traders, stole customer information and demanded about ¥8 billion (roughly $50 million). GMO Internet Group refused to pay. On October 28, it offered up to $1 million for tips that lead to the attackers' arrest.
The breach didn't stay inside GMO. Trading logins saved on those servers were used to place unauthorized trades at several Japanese FX brokers, and brokers are now forcing two-step login on every client. It also lands in the middle of a wider wave of attacks on Japanese companies that has pushed Prime Minister Sanae Takaichi to order emergency cyber measures.
This guide to the GMO cloud breach covers what happened day by day, how the attack chain worked, what GMO has and hasn't confirmed, how the $1 million bounty works, who gets compensated, and what traders, hosting providers and developers should do now.
From the first customer inquiry to a $1 million bounty in ten days. All dates are in 2026, Japan time.
What is Onamae.com Desktop Cloud?
Onamae.com Desktop Cloud is a virtual private server (VPS) service run by GMO Internet, a subsidiary of GMO Internet Group. Customers rent a Windows desktop in GMO's data center and connect to it remotely.
Many of those customers are retail FX traders. They use the servers to run MetaTrader 4 or MetaTrader 5 (MT4/MT5) around the clock, often with automated trading programs called Expert Advisors. A server keeps running when the trader's own PC is switched off, and it sits close to the broker's systems, which reduces delay.
That convenience is also the weak point. To trade automatically, the server has to stay logged in to the trader's broker account. Login IDs and passwords are often saved inside the trading software. Whoever controls the server can see them.
GMO cloud breach: the key facts
ItemDetailServiceOnamae.com Desktop Cloud (Windows VPS), run by GMO InternetDiscoveredOctober 20, 2026: malicious programs found on some customer serversServers potentially affected26,739 (an investigation boundary, not a count of confirmed intrusions)ConfirmedUnauthorized access and exfiltration of customer information (October 24)Ransom demandAbout ¥8 billion (about $50 million) in cryptocurrency, received October 21GMO's answerRefused to pay; working with police in Japan and abroadDownstream damageUnauthorized trades at FX brokers using leaked loginsBountyUp to $1 million in total, open from noon on October 28Market reactionShares fell about 15.7% on October 26, then rose 5.2% to ¥3,324 on October 28
How the GMO cloud breach unfolded
October 19–21: discovery and shutdown. GMO began investigating after a customer inquiry on October 19. The next day, it found that a third party had installed malicious programs on some customer servers. On October 21, it shut down servers on every plan. The same day, it received an email demanding about ¥8 billion from people it believes carried out the attack, and customers began reporting trades they didn't recognize.
October 22–24: police, brokers and confirmation. GMO consulted the police on October 22. Broker FXTF warned that third parties might have stolen the logins of customers who use VPS servers. On October 23, GMO told the Tokyo Stock Exchange that 26,739 servers were potentially affected. On October 24, it confirmed a security problem in the service, unauthorized access, and the exfiltration of customer information. It also announced compensation and asked government agencies for help under Japan's new active cyber defense framework.
October 25–26: the CEO's admission. In a blog post, group chief executive Masatoshi Kumagai wrote that GMO's own white-hat hackers had warned the team running the service about security problems in advance, but the response was neither fast nor thorough enough. "The internet itself is now starting to break down," he wrote, as Reuters reported. GMO shares fell almost 16% on Monday, October 26, to a four-month low.
October 27: the leak. The attackers had set noon on October 27 as the deadline to publish customer information and launch ransomware against customers' PCs. They posted material they said was customer data on their website. No ransomware attack had been confirmed by 1:55 p.m. that day.
October 28: takedown and bounty. The leak site's domain, including mirror sites, was suspended at about 4 a.m. Japan time after GMO worked with other companies. At noon, the $1 million bounty opened.
How stolen server logins became unauthorized trades
Solid boxes show what GMO or brokers have confirmed. Dashed boxes are attackers' claims or threats that GMO has not confirmed.
The damage from the GMO cloud breach spread in two directions.
Inside GMO, the attackers placed malicious programs on customer servers and took customer information. Anything a customer stored on a server may have been viewed, including logins saved in MT4 and MT5. GMO says it doesn't keep customers' payment card data on these servers.
Outside GMO, the stolen logins were used at brokers. OANDA Japan confirmed that a third party logged in to some customers' accounts and traded using ID and password pairs it believes leaked from the GMO servers. As of October 26, it had found no break-in or leak in its own core systems. Dukascopy Japan said some of its clients who used the GMO service had trades placed without their consent. It reset passwords on accounts with suspected unauthorized logins and ended every open session. By October 26, five brokers had confirmed unauthorized trades, according to Finance Magnates.
This is the part that worries me most as a developer. The brokers' own systems don't appear to have been hacked at all. The attackers simply logged in with valid credentials taken from the servers, so to the broker those logins looked exactly like the customer. No firewall or intrusion alarm at the broker would have fired, because nothing was technically "broken into" there. The weak link was a password sitting in a config file on someone else's server.
The attackers also threatened to keep manipulating accounts at more than 70 securities and FX firms, to publish details of GMO's systems and customers' PCs, and to hit those PCs with ransomware.
What GMO hasn't confirmed
As of October 28, GMO had not explained how the attackers behind the GMO cloud breach got in. That leaves several claims unverified:
A shared administrator account. On their site, the attackers claimed that one administrator account was shared across all the servers, ITmedia NEWS reported.
Customer PC drives visible from the servers. They also claimed that customers' local drives were visible from the servers by default when customers connected, and that a flaw in the service let them reach customers' own PCs.
Ransomware on customer PCs. GMO collected PCs from customers who offered them for analysis. By 11:59 a.m. on October 27, it had found no malware, including ransomware, on the PCs it had finished checking. That's a partial result. It doesn't prove every connected device is clean.
The second claim deserves an explanation, because it describes a real Windows feature. When you connect to a Windows server over Remote Desktop Protocol (RDP), your client can share your local drives, clipboard and printers with the remote session. This is called drive redirection, and it's how you copy a file from your laptop to a server by dragging it across. If an attacker controls the server while you're connected, a redirected drive can give them a path to files on your own PC. Whether that happened here is unconfirmed, but it's a well-known risk that RDP hardening guides tell administrators to address.
There's also an attribution question. TechCrunch reported that GMO's own cybersecurity unit had found evidence, about a week earlier, that a Chinese AI-enabled penetration testing tool called Artex was used in attacks on companies across Japan. GMO has not linked Artex to this breach.
How the $1 million bounty works
GMO Internet Group launched the bounty eight days after the GMO cloud breach was discovered. It runs and pays for the program itself, called GMO Cybercrime Bounty. Based on the company's announcement and The Hacker News:
What pays: only a tip that helps lead to an arrest, including one by police outside Japan, or to an international wanted notice such as an Interpol Red Notice. Useful-looking information alone doesn't earn money.
What GMO wants: information linking people, servers, domains, IP addresses, accounts or cryptocurrency addresses to the attack, the extortion or the movement of money, plus evidence of how the crimes were committed. Guesses, unsupported accusations and reposts of public information generally don't qualify.
How much: up to $1 million in total. GMO decides how much each tip helped, and one person can receive the full amount or it can be split.
How to submit: by email to the address on the official site, in Japanese, English or Chinese. Tips can be anonymous, but tipsters must prove their identity before any payment.
Deadline: an arrest, an international wanted notice or October 27, 2027, whichever comes first.
Who can't be paid: anyone involved in the crime, anyone who obtained information illegally (for example, by buying leaked data) and GMO staff.
GMO also tells tipsters not to break into systems, negotiate with or pay the attackers, or send leaked data, credentials or malware. It says it will never ask tipsters for passwords, authentication codes or fees, and it writes only from addresses ending in @cybercrimebounty.gmo. Treat any other "GMO bounty" message as a scam.
Bounties like this are rare for a private company. Governments run reward programs for wanted cybercriminals, but a listed company putting its own money on the table is unusual. It sends a clear message to the attackers: GMO would rather pay for their arrest than pay them.
Will it work? I'm cautiously optimistic, for one reason. A $50 million crypto demand only has value if the attackers can eventually move and cash out the money, and cash-outs leave trails through exchanges, wallets and people. A $1 million reward gives anyone close to that chain, including someone inside the group, a strong reason to talk. Bounties rarely catch attackers on their own, but they can turn a small mistake into an arrest.
Who gets compensated, and how much
GMO's payments stack by category of published data, up to ¥3 million per disclosure, on top of the ¥5,000 goodwill payment and confirmed trading losses.
In a filing to the Tokyo Stock Exchange, GMO listed six kinds of payment linked to the GMO cloud breach:
¥5,000 for every current user as a goodwill payment.
Actual trading losses and fees from trades GMO confirms were unauthorized and caused by the breach.
¥10,000 if GMO confirms a customer's basic information, such as name and contact details, was published.
¥15,000 if financial or authentication information, such as trading account IDs and passwords, was published.
¥25,000 if sensitive or highly private personal information was published.
A new PC for any customer hit by ransomware.
The disclosure payments are added together by category, up to ¥3 million per disclosure. GMO will also offer customers who want a Windows desktop a move to a separate service, free for six months and only with their consent. It won't restart the breached systems as they are.
GMO says it can't yet calculate the total cost, because it doesn't know how many customers qualify or what the published data covers.
Brokers are locking down logins
The GMO cloud breach is already changing how Japanese FX brokers handle security, and not only for GMO customers.
FXTF, which runs more than 280,000 accounts, has gone furthest. From Saturday, October 31, it will lock clients out of its client portal and FXTF GX platform unless they turn on two-step login. It already required one-time passwords on MT4 and MT5, and the codes go to each client's registered email address, so anyone whose inbox can't receive them will be shut out. FXTF also told affected customers to change their passwords from a device that had never connected to Desktop Cloud, which is a smart detail: if a PC was compromised, typing a new password on it would hand that password straight to the attacker.
OANDA Japan is strengthening MT5 login security and has asked clients on rented servers to change the default remote desktop port and restrict which IP addresses can connect. Dukascopy Japan reset passwords on accounts with suspected unauthorized logins and ended every open session.
We've seen this pattern before. In Poland last year, broker XTB made two-step login compulsory for all clients within hours of a customer saying hackers had drained his account. Honestly, it's a little frustrating that it takes a breach to make this the default. When passwords leak at scale, a second factor is the one control that still stops the login, and it should have been compulsory for trading accounts years ago.
The bigger picture: Japan's cyberattack wave
The GMO cloud breach isn't an isolated case. There were 723 cybersecurity incidents in Japan in the year to October 20, according to TrendAI, a unit of Trend Micro, which is already more than the full-year totals for 2025 and 2024. Satoshi Nagano, president of ESET Japan, told Reuters that the rise may reflect both more threats and better visibility into incidents that previously went undetected or undisclosed.
Other recent cases include:
Park24, operator of the Times car-sharing service, will pay ¥3,000 to customers after a personal data breach last month. It expects an extraordinary loss of ¥5.5 billion and will stop keeping identity document images after verification.
Critical PHP vulnerabilities disclosed this month prompted millions of hacking attempts and knocked government and company websites offline in Japan, Europe and elsewhere. GMO has not linked its breach to the PHP flaws. ByteMuni has a practical guide to patching the PHP2Shell flaws on PHP web servers if you run PHP in production.
Security experts quoted by Reuters say AI is helping attackers automate work such as scanning for vulnerabilities and writing phishing messages, which makes cybercrime faster, cheaper and harder to detect.
The government is responding on several fronts. Japan began active cyber defense operations on October 1, 2026 under a law passed in 2025, which lets police and the Self-Defense Forces neutralize harmful programs on attackers' servers when they detect signs of a serious attack. The government also said it would set up a team that uses AI to simulate cyberattacks and find weaknesses. Prime Minister Takaichi has asked her cabinet to prepare an emergency package of anti-cyberattack measures by the end of next week.
What affected traders should do now
If you used Onamae.com Desktop Cloud before the GMO cloud breach, GMO and the brokers recommend these steps:
Change your trading account and trading software passwords from a device you don't use for FX trading, such as your phone.
End every logged-in session, through your broker if necessary, even after changing your password.
Check your trading history and balances, and report any trades you don't recognize to your broker first.
Turn on two-factor authentication wherever your broker offers it.
Change any reused passwords, including passwords saved in your browser.
Run a full antivirus scan on every device you used to connect, and back up your data.
Don't visit the attackers' site or any copy of it. GMO says the site collected information about visitors.
Ignore anyone offering to recover your money for a fee, and never reply to messages from people claiming to be the attackers.
GMO's support line is open 24 hours a day, including weekends and holidays.
Lessons for hosting providers and developers
GMO hasn't published a root cause for the GMO cloud breach, so these aren't conclusions about what went wrong at GMO. They're the standard controls that the confirmed facts and the attackers' claims point to, and they apply to anyone running remote desktops or multi-tenant servers:
Act on internal findings quickly. GMO's chief executive has admitted that its own white-hat hackers raised problems before the attack. A penetration test only helps if findings get an owner and a deadline.
Never share administrator credentials across tenants. Each server should have a unique local administrator password, rotated automatically. One stolen credential shouldn't open thousands of machines.
Turn off RDP drive and clipboard redirection by default. Windows lets administrators disable these through Group Policy. Customers who need file transfer can use a safer, explicit method.
Don't expose RDP to the whole internet. Use network-level authentication, a VPN or gateway, IP allowlists and multi-factor authentication.
Assume saved credentials will leak. Brokers should require a second factor for logins and treat new devices and locations as suspicious, and traders should avoid storing passwords on shared infrastructure where possible.
Plan the communications as carefully as the fix. GMO has published more than a dozen incident reports, a 24-hour support line and clear anti-scam warnings. Clear, frequent updates help customers protect themselves.
If you're building AI agents or automated systems that can move money, the same principle applies: separate what a system can decide from what it's allowed to do. ByteMuni's piece on AI agents in bank accounts looks at that problem from the agent side.
Should Indian traders worry?
Many Indian traders and developers rent Windows VPS servers to run MT4 or MT5 around the clock, so the risk exposed by the GMO cloud breach isn't unique to Japan. Any trading server that keeps broker logins saved, accepts remote desktop connections from anywhere and shares your local drives has the same weak points.
There's also a legal point worth knowing. The Reserve Bank of India allows resident individuals to trade forex only in permitted currency pairs, on recognized Indian exchanges, through authorized brokers. It also keeps an Alert List of unauthorized forex trading platforms. If your money sits with an offshore broker that isn't authorized in India, you'll have far fewer options for getting it back after a hack than GMO's Japanese customers have.
If you run a trading VPS today, three checks take less than ten minutes:
Turn on two-factor login at your broker and on the VPS itself, if either supports it.
Disable drive and clipboard sharing in your Remote Desktop client before you connect (Show Options, then Local Resources).
Restrict remote desktop access to your own IP address in the VPS provider's firewall, and use a password you don't use anywhere else.
My take
GMO has handled the aftermath of the GMO cloud breach better than most companies I've seen. It shut the service down within a day, refused to pay, published thirteen incident reports in eight days, set up a 24-hour helpline, put a clear price on compensation and launched a bounty. That's what good incident response looks like, and other companies could learn from it.
But the most important sentence in this whole story came from GMO's own chief executive, not from the attackers. Masatoshi Kumagai admitted that the company's white-hat hackers had flagged problems before the attack, and the response wasn't fast or thorough enough. That's the real lesson. Most breaches don't happen because nobody knew about the risk. They happen because someone knew, wrote a ticket, and the ticket waited.
The second lesson is about convenience. A trading server that stays logged in to your broker, keeps your password saved and can see your PC's drives is very convenient. It's also exactly what an attacker wants. Every one of those features should be something a user turns on deliberately, not something they get by default.
The bottom line
The GMO cloud breach shows how one compromised hosting service can turn into account takeovers at many other companies. GMO has done several things right since the discovery: it refused the ransom, shut the service down, published frequent updates, promised compensation and put up its own $1 million bounty. But its own chief executive has admitted that earlier warnings weren't acted on fast enough, and the entry point is still unknown.
For traders, the immediate priority is simple: change your passwords from a clean device, end your sessions and turn on two-factor login. For everyone who runs servers, the lesson is that shared credentials and convenience features like drive redirection can turn one breach into thousands. More coverage is in ByteMuni's cyber security section.
This story is developing. Figures are as reported by GMO, Reuters, The Hacker News, Finance Magnates and TechCrunch up to October 28, 2026.
Sources
Japan's GMO offers $1 million bounty to catch hackers behind FX trading cloud breach — The Hacker News, Oct 28, 2026
Japanese companies compensate users as cyberattacks buffet economy — Reuters, Oct 26, 2026
GMO offers $1 million bounty for hackers as Japanese brokers tighten logins — Finance Magnates, Oct 28, 2026
Japan internet giant GMO says hackers posted stolen customer data — TechCrunch, Oct 27, 2026
Current response to unauthorized access to "Onamae.com Desktop Cloud" (Thirteenth Report) — GMO Internet, Oct 28, 2026
Notice regarding unauthorized access to a service provided — GMO Internet, Oct 23, 2026
Japan to begin active cyber defense operations in October — Adnkronos, Mar 17, 2026
Frequently asked questions
What happened in the GMO cloud breach?
Attackers installed malicious programs on servers in GMO Internet's Onamae.com Desktop Cloud, a Windows VPS service popular with FX traders, and stole customer information. GMO found the intrusion on October 20, 2026, shut the service down on October 21 and says up to 26,739 servers may have been exposed.
How much ransom did the hackers demand from GMO?
About ¥8 billion, or roughly $50 million, in cryptocurrency. GMO received the demand on October 21, 2026 and refused to pay. It is working with police in Japan and abroad.
How does the GMO $1 million bounty work?
GMO pays only if a tip helps lead to an arrest or an international wanted notice such as an Interpol Red Notice. Tips can be sent anonymously in Japanese, English or Chinese through the official site. The program runs until an arrest, a wanted notice or October 27, 2027.
Were FX broker accounts hacked?
Logins saved on the GMO servers were used to log in to accounts at brokers including OANDA Japan and Dukascopy Japan and place unauthorized trades. The brokers say they found no breach of their own core systems.
What compensation will GMO customers get?
Every current user gets ¥5,000. GMO will also cover confirmed losses and fees from unauthorized trades, pay ¥10,000 to ¥25,000 per category of published personal data (up to ¥3 million per disclosure), and give a new PC to anyone hit by ransomware.
What should affected traders do?
Change trading passwords from a device you don't use for trading, end all active sessions, check your trade history, turn on two-factor authentication, change reused passwords and run a full antivirus scan. Don't visit the attackers' site or pay anyone offering to recover funds.
How this article was made: researched and edited by Deepak Kumar, drafted with help from AI tools.
