Fraud Management & Cybercrime
,
Ransomware
Extortion Group Holding to Ransom Data Stolen From Virtual Private Server Customers
Mathew J. Schwartz (euroinfosec) •
October 28, 2026
Image: Shutterstock
Japan’s GMO Group is offering a bounty of up to $1 million for information that helps unmask whoever hacked the company, made unauthorized trades and stole customer data.See Also: Live Webinar | Hurtling Toward a Cybersecurity Crisis: The Hidden AI Risks Businesses Can’t See
The publicly traded company is one of Japan’s largest web hosting providers and domain registrars. It suspended the “Onamae.com Desktop Cloud” service it leases to customers for foreign exchange margin trading on Oct. 21, after detecting unauthorized access and receiving a ransom note demanding 8 billion yen – $50 million.
The service functions as a cloud-based virtual private server as well as Windows virtual desktop service, which is designed for automated FX trading.
In a series of regular updates over the past week detailing the results of its ongoing investigation, GMO Group said attackers accessed up to 26,739 virtual servers, may have installed malware on the home PCs through which users remotely connected, and stole data as well as making unauthorized transactions. The company said customers’ credentials for the MetaTrader 4 and MetaTrader 5 electronic trading platforms may have been compromised and urged them reset those passwords.
Three days after making their first demand, the extortionists on Saturday said they’d settle for a $1 million ransom. They set a payment deadline of Tuesday at noon. “The perpetrator has demanded money and threatened to manipulate our customers’ trading accounts and to publish their information,” GMO Group warned.
Instead of paying, its 63-year-old founder and CEO, Masatoshi Kumagai, posted a reward to anyone who helps unmake the threat actor.
“We will never give in to the extortion demands,” reads the cybercrimebounty.gmo launched by GMO Group on Wednesday, alongside a telephone hotline, seeking tips.
“We are seeking credible information that leads to the identification and arrest of those involved in the unauthorized access to Onamae.com Desktop Cloud and related crimes, and to the full resolution of the incident,” the site says.
The bounty is designed to gather information about the individuals involved, any infrastructure tied to their attack or extortion efforts, details tied to how the group handles funds, as well as specifics about “how the crime was carried out and directed,” GMO Group said. By the end of business on Wednesday, the company said it had already received more than 100 tips.
The bounty is open for the next year, or until a perpetrator gets arrested or an international arrest notice issued by law enforcement.
The company told customers and investors that “based on our social responsibility not to encourage such criminal activity,” it wouldn’t be giving attackers a single yen.
“This is because complying with the demands does not guarantee the deletion of the acquired information or the prevention of its misuse. Furthermore, complying with the demands would lead to funding criminals and criminal organizations, which could encourage further cyberattacks and create new damage,” it said.
The company said it’s been working closely with police, as well as cybersecurity firm Trend Micro, including to analyze customers’ PCs for signs of malware.
GMO Group has apologized for the incident, said it will give all affected Onamae.com Desktop Cloud customers – operated by its GMO Internet group – 5,000 yen – $32 – in compensation, as well as up to 3 million yen – $19,000 – if their personal data has been exposed, including name, contact information, financial details or other sensitive information.
The company also promised to reimburse any customer who experienced an attacker-initiated trading losses.
The company hasn’t said how it got breached. The attackers, on their currently offline data leak site, claimed to have exploited a remote desktop protocol flaw to access the GMO Group infrastructure. They said the Onemae Desktop Cloud’s RDP settings set “drive redirection” to be enabled, meaning when a user connected to the VPS, their local files were shared by default. The attacker said that in addition, “the VPS network was configured in an ‘Active Directory’ environment, which is a configuration that should never be used for a VPS network,” because it gave them a way to directly move to other VPS servers, after they intercepted an admin password exposed whenever a support engineer remotely connected to a remote user’s PC.
The attackers claim to have stolen authentication information, email address and balances tied to the MT4 and MT5 accounts, as well as browsing history, authentication details and data from customers’ home PCs.
Ransomware Threat Against Users
On Monday, GMO Group warned that attackers were not threatening to unleash ransomware they’d planted on customers’ home PCs to crypto-lock the data, after 12 p.m. local time Tuesday. In response, GMO Group urged all customers to perform a full endpoint security scan of their PC, back up their systems and to power down their PC and disconnect all cables in advance of that time.
Subsequently, it reported that attackers didn’t appear to have followed through on that threat. But the extortionists on Tuesday did begin leaking stolen details pertaining to the company’s customers.
By early Wednesday, GMO reported that the leak site and multiple mirrors, including on the darknet, were shut down, although the attacker appears to be attempting to stand up new versions. Later on Wednesday, GMO Group said it issued a total of 20 takedown notices to social platform X, tied to posts that attempt to disseminate directions for reaching one of the extortionist’s data leak sites.
GMO Group said it hasn’t yet verified if all of the leaked information is genuine. It also requested the media refrain from disseminating it or the locations of the leak sites.
——————————————————–
Click Here For The Original Source.
