The disclosure of the breach on October 20, 2026, revealed that unauthorized third parties had installed malicious programs on customer servers. GMO Internet stated that up to 26,739 servers were potentially affected. In response, the company progressively shut down the affected servers to contain the threat and launched an internal investigation. The breach exposed sensitive customer data, specifically MetaTrader 4 and MetaTrader 5 (MT4/MT5) credentials and trading account details. While GMO assured customers that payment information had not been compromised, it warned that the leaked credentials had already been exploited for unauthorized trading activity on some accounts.
The situation escalated on October 21 when the attackers issued an extortion demand for approximately $50 million (roughly ¥8 billion). GMO Internet publicly refused the demand, citing the lack of guarantee that payment would secure the stolen data. Following the refusal, the attackers threatened to launch a ransomware attack on user devices. On October 27, the group posted material on a website claiming it contained information about GMO and its customers. GMO Internet urged its customer base to take immediate defensive measures, including disconnecting computers from the internet, shutting down systems, and terminating active trading sessions to prevent further unauthorized activity. The attackers’ website and its mirror sites were taken down at approximately 4 a.m. Japan time on October 28.
The bounty program, which opened on October 28, is structured to incentivize forensic leads rather than mere speculation. Tips are accepted in Japanese, English, or Chinese and can be submitted anonymously via email. However, compensation is contingent upon the tip leading directly to an arrest by local or international police, or the issuance of an international wanted notice, such as an Interpol Red Notice. The program remains open until an arrest is made, a wanted notice is issued, or October 27, 2027, whichever occurs first. GMO Internet has specified that the $1 million total can be awarded to a single tipster or split among multiple contributors, depending on the relative value of the information provided. Eligible evidence includes links between individuals, servers, domains, IP addresses, cryptocurrency wallets, and the attack itself. General accusations or reposts of publicly available data do not qualify.
To maintain the integrity of the investigation, GMO has established strict exclusions for the bounty. Individuals involved in the crime, those who acquired information through illegal means such as purchasing leaked data, and GMO staff members are ineligible for payment. Furthermore, tipsters are explicitly instructed not to engage in unauthorized system access, negotiate with the attackers, or transmit stolen data, credentials, or malware samples to the company. All tips will be shared with law enforcement agencies in Japan and abroad as necessary. GMO has already handed over all available evidence, including communication records related to the threats, to the police.
CEO Masatoshi Kumagai acknowledged significant internal failures during the incident, admitting that security teams had previously identified vulnerabilities but failed to remediate them with sufficient speed. The company reported that the attackers utilized autonomous penetration testing tools, highlighting the growing sophistication and speed of AI-assisted cyberattacks. In the immediate aftermath, GMO announced it would compensate each affected customer with ¥5,000 (approximately $30) for the inconvenience. The incident has also prompted GMO to propose a national proactive cyber defense strategy to the Japanese government, underscoring the critical need for rapid vulnerability management in cloud-based financial infrastructure. The company continues to work with trading platforms to block traffic from the compromised environment and terminate any remaining active sessions associated with the stolen credentials.
