GMO Internet Group Cyberattack: Timeline of the Ransom Standoff, Data Leak and ¥150M Bounty
One of Japan's largest internet groups says it will not pay, will not negotiate, and will pay a bounty instead. Here is how the standoff unfolded, day by day.
Compiled from live news data by NewzAI · October 28, 2026
A ransom standoff played out in public
GMO Internet Group told its customers to switch off their PCs before a noon deadline on October 27, then watched the attackers publish customer data when it refused to pay. By the next day it had restricted the attackers' website, opened a tip line, and put up a bounty of about ¥150 million for information that identifies them. Read on NewzAI →
Image credit: Tokyo Reporter
What was hit
The intrusion targeted servers used for automated foreign exchange (FX) trading. GMO said some users' login information leaked and that unauthorized operations were carried out in their trading accounts. It stopped the server and started an investigation with a security firm. Read on NewzAI → The Sponichi Annex report on the bounty names the service involved as Onamae.com Desktop Cloud. Read on NewzAI →
Tokyo Reporter says GMO has told the public that more than 26,000 servers may have been compromised. GMO has asked affected customers to hand over PCs for analysis, and says it will contact them individually if it finds protective steps they can take. Read on NewzAI →
The timeline, October 21–28
Twelve events across three tracks: what the attackers did, how GMO responded, and what happened around them. Numbers match the cards below.
Around the 21st, hackers begin emailing users directly. Tokyo Reporter says they claimed to have destroyed 17% of customer accounts, about ¥7.7 billion in assets. These figures are the attackers' own claims. Read on NewzAI →
GMO consults police after confirming that trading passwords were exposed. It later says more than 26,000 servers may have been compromised. Read on NewzAI →
GMO announces that the server used for automated FX trading was accessed without authorization and that some users' login information leaked. It halts the server, and President Masatoshi Kumagai apologizes on X and urges password changes. Read on NewzAI →
GMO discloses that it has received a demand for money, backed by a threat to publish customer information. It says it will not pay because deletion of stolen data is not guaranteed. Read on NewzAI →
GMO pledges to compensate losses from confirmed unauthorized trades and a flat ¥5,000 goodwill payment to users. It also asks the government for measures including active cyber defense. Read on NewzAI →
In a blog post, Kumagai reveals a demand for $50 million (about ¥8 billion) in crypto. He also writes that GMO's internal white hackers had warned about the vulnerabilities used, and that fixes were delayed to protect service availability. Read on NewzAI →
Tokyo Reporter reports that GMO shares fall by more than 15% on Monday as investors react to the breach. Read on NewzAI →
The attackers' deadline: publish customer data and launch ransomware at noon. GMO tells affected users to back up data and switch off their PCs, and says it will not comply. Read on NewzAI →
At 12:30 p.m. GMO confirms the attackers have posted information claiming to belong to users. It warns the content may contain falsehoods, tells people not to visit the site, and says the threatened ransomware had not been observed as of 1:55 p.m. Read on NewzAI →
GMO creates a bounty fund capped at $1 million (about ¥150 million) and announces payouts of up to ¥3 million for users whose data was published. Read on NewzAI →
The attackers' domain, registered in August on a US shared host, is placed under usage restrictions. GMO says it will act on any similar site as soon as it is confirmed. Read on NewzAI →
The bounty tip line opens at noon. Within about six hours GMO reports 113 submissions and says it will publish counts regularly until arrests or international wanted notices. Read on NewzAI →
Dates follow publication dates of the cited reports and may differ slightly from when events occurred. Sources report conflicting details on some points, noted in the text.
The ransom demands
Reports disagree on the amount. President Masatoshi Kumagai disclosed on his blog a document demanding $50 million in Bitcoin or Ethereum, according to Tokyo Reporter. Other coverage describes a demand of about $1 million, and TV Asahi's report says an expert survey judged that figure likely while GMO itself did not confirm the amount. Read on NewzAI → GMO's position has not moved: giving in would not guarantee that stolen data is deleted or misuse prevented. Read on NewzAI →
Log scale: each step to the right is 10 times larger. Yen conversions are approximate and follow the reporting outlets' own figures.
GMO's compensation tiers start at ¥10,000 for exposed names and contact details and rise with the sensitivity of the data, up to a ¥3 million cap, according to ABEMA TIMES. Read on NewzAI → News On Japan reports ¥15,000 for exposed account IDs and passwords. Read on NewzAI →
When the data went public
On October 27 a site believed to belong to the attackers published what it called "victim number one", listing an address, name, age and phone number, plus family makeup, occupation and bank account credentials, according to ABC News. Read on NewzAI → The attackers threatened to add new data every day at noon. A day later GMO confirmed the domain had been restricted and said it would move against similar sites as they appear. Read on NewzAI →
Image credit: Yahoo! Japan News / MBS News
Osaka University professor Atsuo Inomata told MBS that stolen names, emails and photos are typically shared and resold among criminals, and that individually cheap records add up at the scale of millions. The same report says personal data leaks of up to 220 million records were identified at GMO over about a month, from late September to late October. MBS also cites a case of roughly ¥1.2 million in damage. Read on NewzAI →
Who is behind it?
The attackers built a public website, hosted it on a standard network rather than the dark web, and published detailed descriptions of GMO's weaknesses. Mitsuo Miwa, president of security firm S&J, told ABC News that professionals usually negotiate quietly and move on, so this behavior looks inefficient as a money-making effort. He sees a strong desire for recognition and says the attackers may not be professionals. Read on NewzAI →
IT journalist Kenta Yamaguchi adds that the domain was registered in August and used a US shared-hosting provider, and that the account may have been hijacked from someone else. Because the provider honored the takedown request, GMO could block publication on that domain, though Yamaguchi notes that other hosts decline such requests. Read on NewzAI →
The question GMO now faces
Kumagai wrote that GMO's own white hackers had warned about the vulnerabilities that were exploited and that fixes were delayed to prioritize availability. In the words Tokyo Reporter attributes to him: "Our depth and speed of response were insufficient, and the attackers exploited that gap." Read on NewzAI →
Yamaguchi's commentary raises a second claim: that a source who repeatedly reported vulnerabilities to GMO was ignored, and that this history may explain the attack. He reads the money demands as largely formal and argues that a technical account of the cause and the fix would do more to resolve the matter than any payment. Read on NewzAI → These accounts come from commentary, and GMO has not confirmed the second one in the reports we reviewed.
The bounty and the tip line
GMO's "Cyber Crime Eradication Bounty" is capped at $1 million across the whole program. It covers information that identifies suspects, the servers and domains used, and the flow of money. Payments depend on how new, accurate and verifiable a tip is, and GMO says submitting a tip does not guarantee a reward. Read on NewzAI →
Image credit: Yahoo! Japan News / Sponichi Annex
A bad year for Japanese cybersecurity
News On Japan counts 723 cybersecurity incidents in Japan by October 20, 2026, already more than the full-year totals for 2024 and 2025. It lists Park24's Times Car breach (about 6.62 million accounts), the Aflac Life Insurance Japan breach (about 4.38 million policyholders), the Nichirei disruption, and the 2025 ransomware attacks on Asahi and Askul as recent examples. Read on NewzAI → GMO's case differs in one way: the victim is answering the attackers with a public bounty instead of a quiet negotiation.
What to watch
Four questions will decide how this ends. Will the attackers publish through another host? Will GMO publish a technical explanation of how they got in? Will the tip line lead to arrests or an international wanted notice, which GMO has named as its milestones? And will the government act on GMO's request for active cyber defense measures? Read on NewzAI →
Follow This Story on NewzAI
NewzAI tracks breaking news in real time — summarised from multiple sources so you get the full picture, not just a headline.
GMO Offers 150 Million Yen Reward to Identify Cyberattackers →
Tech giant GMO refuses $1M ransom demand from hacker syndicate →
Site shutdown of the group that attacked GMO →