The attackers initially demanded approximately $50 million, or roughly ¥8 billion, with payment reportedly requested in Bitcoin and Ethereum. The original deadline was October 21. Japanese reporting subsequently said the attackers reduced the demand to $1 million and set a new deadline of noon on October 27.
GMO said it made no payment and would not comply with the attackers’ demands because paying would provide no guarantee that stolen information would be deleted or protected from further misuse.
The incident has since moved beyond a ransom demand. On October 27, people believed to be responsible published information they claimed belonged to GMO and its customers. GMO said it was still verifying the material and warned that some of the published information could be inaccurate.
What Happened to GMO’s 26,739 Cloud Servers?
GMO began investigating on October 19 after receiving a customer inquiry and confirmed the following day that malicious software had been installed in some customer server environments.
The company began shutting down all Onamae.com Desktop Cloud plans from 4 a.m. Japan time on October 21 to contain the incident. It identified 26,739 servers as potentially affected, although that figure represents server environments that may have been exposed rather than 26,739 confirmed compromises.
FinanceFeeds previously reported that the GMO breach prompted OANDA Securities Japan to delay some customer withdrawals while additional security checks were conducted.
The affected cloud service is used by traders to operate software including MetaTrader 4 and MetaTrader 5 continuously on remote machines. Login credentials and other account information stored inside those environments may therefore have been accessible to the attackers.
GMO subsequently confirmed that customer information had been removed from its systems and said customers had reported unauthorized transactions in their trading accounts.
Investor Takeaway
The 26,739 figure measures potentially affected infrastructure, not confirmed victims. The more material financial issue is how many trading accounts suffered unauthorized transactions and how much GMO ultimately pays in compensation.
Did the Attackers Carry Out Their Threats?
The attackers threatened to publish customer information and conduct ransomware attacks if GMO refused to pay. They also threatened further unauthorized activity involving trading accounts connected to more than 70 securities and FX firms in Japan and overseas.
Those claims should not be interpreted as evidence that all of those brokers were compromised. They were threats attributed to the attackers.
By 12:30 p.m. on October 27, GMO had confirmed that information claimed to belong to the company and its customers had been published online. The company began reviewing the material and said it would contact customers individually where exposure was confirmed.
GMO also asked customers to avoid visiting or circulating the attackers’ site, warning that the attackers could collect information about visitors. By approximately 4 a.m. on October 28, GMO said the domain hosting the material had been taken down.
Importantly, the threatened ransomware attack has not been confirmed. GMO’s latest analysis of customer devices found no evidence of malware infection or ransomware activity on the machines examined so far, although the investigation remains ongoing.
How Much Could GMO Have to Pay Customers?
The direct financial cost of the incident remains uncertain. GMO has committed to compensate customers for realized losses caused by unauthorized trading that its investigation confirms resulted from the breach.
FinanceFeeds reported one case in which a Japanese FX trader alleged approximately ¥1.8 million in losses from unauthorized transactions. Another customer reportedly suffered losses of about ¥550,000.
Those cases establish that some customers experienced financial damage but do not provide a reliable estimate of GMO’s total liability. The company has not disclosed the number of valid compensation claims or an aggregate loss figure.
GMO will also pay ¥5,000 to every current Onamae.com Desktop Cloud customer regardless of whether they experienced unauthorized trading. The goodwill payment is separate from compensation for confirmed direct trading losses.
The wider effects have reached individual brokers. AvaTrade Japan confirmed unauthorized access and transactions involving some customer accounts after warning customers who used external services, including VPS providers. However, a direct technical connection between every affected AvaTrade account and GMO’s infrastructure has not been established.
Investor Takeaway
GMO’s eventual liability depends on verified trading losses, customer-data exposure and recovery costs rather than the ransom itself, which the company refused to pay.
Why Did GMO Refuse the Crypto Ransom?
GMO said paying the attackers would not guarantee deletion of the stolen information or prevent its subsequent misuse. The company instead referred the matter to police and relevant authorities and began pursuing the attackers through legal, technical and investigative measures.
On October 28, GMO escalated that response by creating a cybercrime reward program offering up to $1 million for information that could help identify and apprehend those responsible. Within six hours of launching the program, the company said it had received 113 submissions.
The distinction between the attackers’ alleged $1 million reduced ransom and GMO’s new $1 million reward is important. The reward is being offered by GMO for information about the perpetrators; it is not a payment to the attackers.
The incident also demonstrates how a breach of third-party trading infrastructure can spread financial risk beyond the technology provider itself. Compromised VPS credentials can potentially provide access to brokerage accounts even when a broker’s own systems have not been breached.
For GMO, the investigation is therefore no longer primarily about whether to pay an extortion demand. The larger questions are the number of customers whose information was exposed, the scale of unauthorized trading losses, the cost of compensation and when the affected cloud service can safely return to normal operation.
