Japan’s GMO Refuses Ransom After VPS Breach and Offers $1 Million Bounty

GMO Internet will not restart its breached Onamae.com Desktop Cloud platform in its current form. Attackers planted malicious programs in some customers’ server environments and took customer data. The Japanese provider refused a ransom demand of $50 million and will offer customers an alternative service on a separate cloud, free for six months. On October 28, GMO Internet Group launched a reward of up to $1 million for information that helps identify those responsible.

Desktop Cloud is a virtual private server service with a Windows desktop, aimed at automated foreign-exchange trading on the MetaTrader 4 and 5 platforms. GMO Internet also runs Onamae.com, which it markets as Japan’s largest domain registration service. Since its second report, it has published its incident updates jointly with GMO Internet Group.

From a Customer Inquiry to a Full Shutdown

According to GMO’s timeline, the company began investigating on October 19 after a customer inquiry. On October 20 it confirmed that a third party had installed malicious programs in some customers’ server environments, and it stopped new sign-ups and the control panel. From 04:00 Japan time on October 21, it began shutting down servers on all plans. GMO puts the number of servers that may have been affected at 26,739, a figure it describes as the servers in scope, not confirmed cases of intrusion or data theft. It has also warned that information stored on them, including account logins saved in trading software, may have been viewed.

In its fourth report, on October 24, GMO confirmed that a security problem had existed in the service’s system, that its environment had been accessed without authorization, and that customer information had been taken out. Some customers have reported transactions they did not recognize on their trading accounts. Together with a specialist security firm, GMO has been investigating how the attackers got in.

A Ransom Demand, Then a Leak Site

GMO received an extortion email on October 21 from people it believes to be the attackers, demanding $50 million, about ¥8 billion. According to the company, the attackers threatened to keep manipulating customers’ trading accounts at more than 70 securities and foreign-exchange firms in Japan and abroad, to publish information about the service and about customers’ PCs connected to it, to launch ransomware attacks, and to publish details of GMO’s systems and operations.

GMO has refused to pay and has ruled out paying at any point, arguing that payment would not guarantee the deletion of stolen data and would fund criminals and encourage further attacks. It contacted the police on October 22. On October 24 it asked government agencies to track, block and neutralize the attackers’ infrastructure under Japan’s active cyber defense framework, and it wants the case treated as the framework’s first activation.

When the attackers warned GMO that they would publish customer data and launch a ransomware attack at noon Japan time on October 27, GMO asked customers to back up their PCs, disconnect them from the network and switch them off. At 12:30 GMO confirmed that the attackers had published information that appears to relate to its customers. The company is still reviewing the material and warns that it may contain false information. It also urged people not to visit the site, which, according to GMO, collects data on its visitors.

By around 04:00 Japan time on October 28, after GMO worked with the relevant companies, the site’s domain had been suspended. In its fourteenth report, later that day, GMO noted no sign of malware infection or of a ransomware attack on the devices it has collected from customers and analyzed so far.

Compensation and a Replacement Platform

GMO will pay every current Desktop Cloud customer ¥5,000, regardless of losses, and will reimburse realized losses from unauthorized trades that it confirms were caused by the breach, after any refunds from the trading firms. Customers whose data GMO finds in the attackers’ publication will receive further payments for each category of information: ¥10,000 for basic details such as names and contact information, ¥15,000 for financial and authentication data such as trading account IDs and passwords, and ¥25,000 for sensitive personal information, with a cap of ¥3 million per publication. GMO has also pledged a new PC of equivalent performance to any customer whose PC it confirms was damaged by ransomware.

The company has decided not to restart the compromised system as it was and to rebuild its security architecture instead. Customers who want to keep a Windows desktop environment will be offered a move to an alternative service running on a separate cloud platform, free for six months, and nobody will be moved without consent. GMO will email details, including the start date, by October 30.

A $1 Million Bounty, Not a Ransom

The bounty, which GMO Internet Group runs and pays for under the name GMO Cybercrime Bounty, caps total payouts at $1 million, about ¥150 million, across all informants rather than per tip. GMO accepts information in Japanese, English and Chinese until an arrest of the perpetrators, an international wanted notice for them such as an Interpol Red Notice, or October 27, 2027, whichever comes first. Payouts require that the information helped bring about such an arrest or notice. It excludes anyone who was involved in the crime or obtained their information illegally, and stresses that the reward is not a ransom.

The bounty site opened at noon Japan time on October 28 and received 113 tips in its first six hours, by GMO’s count. The company adds that its responsibility to find the cause and prevent a recurrence does not depend on the bounty or on the progress of the investigation.