Japan’s GMO Group Offers $1 M Bounty After Hackers Compromise 26,739 VPS Customers and Demand ¥8 Billion Ransom
What Happened — On 21 Oct 2026 GMO Group, a leading Japanese web‑hosting and domain‑registration company, discovered unauthorized access to its “Onamae.com Desktop Cloud” service – a virtual‑private‑server platform used for automated foreign‑exchange (FX) trading. Attackers infiltrated up to 26,739 virtual servers, installed malware on the remote‑desktop PCs that users employed, exfiltrated credentials for MetaTrader 4 and MetaTrader 5, and executed unauthorized FX trades. The perpetrators delivered a ransom note demanding ¥8 billion (≈ US $50 M) and later lowered the demand to US $1 M with a short payment deadline. GMO refused to pay and instead launched a public bounty program, offering up to US $1 M for credible information that leads to the attackers’ identification and arrest. Within the first day the company’s tip‑line received more than 100 leads.
Why It Matters for Trust & Control Assurance — The breach underscores the criticality of strong identity‑and‑access controls and continuous monitoring of privileged cloud‑service accounts.
Who Is Affected — Cloud‑hosting providers, financial‑trading SaaS platforms, and any organization offering remote‑desktop or VPS services.
Recommended Actions — Review and harden privileged‑access policies for cloud‑hosted VMs, enforce multi‑factor authentication for all administrative accounts, deploy continuous log‑analysis to detect anomalous remote‑desktop activity, and validate incident‑response playbooks for credential‑theft scenarios. Source: DataBreachToday
Technical Notes — The attack vector appears to be compromised credentials enabling unauthorized SSH/RDP sessions; malware was dropped onto end‑user PCs. No specific CVE was disclosed. Stolen data includes MetaTrader 4/5 login details and potentially personal identifying information of traders. Source: same article