GMO Internet Group CEO Masatoshi Kumagai confirmed on Oct. 26 that the company refused a $50 million extortion demand from attackers who breached its Onamae.com Desktop Cloud service. The demand, stamped 11:57 on Oct. 21, asked for payment in Bitcoin or Ether by 5 p.m. Japan time and noted that GMO's crypto exchange subsidiary could pay immediately. Kumagai said no demands were met and nothing was paid.
The breach timeline began with a customer question on Oct. 19. Malware was detected the following day, and GMO shut down all service plans from 19:00 UTC on Oct. 20. Up to 26,739 server environments may have been exposed, though GMO stressed that this figure counts potentially impacted servers, not verified account compromises. In-house white-hat hackers had flagged security issues earlier, and Kumagai wrote that the response was lacking in depth and speed, allowing the attacker to pass through the gap.
Individual customers have begun reporting concrete losses. A 37-year-old trader from Osaka said her account balance fell from approximately ¥3 million to ¥1.2 million between Oct. 21 and 22, a loss of about ¥1.8 million ($12,000). Her history showed unfamiliar transactions, including a sell-South African rand and buy-euro trade that reportedly generated a ¥1.19 million loss. Another customer from Saitama Prefecture said he lost roughly ¥550,000 and received an email from a group claiming responsibility and threatening to release customer information.
GMO has promised to compensate customers for realized trading losses and associated fees resulting from unauthorized transactions that its investigation confirms were caused by the incident. Ordinary market losses, hypothetical profits and indirect damages are excluded. Separately, GMO will pay ¥5,000 to every current Onamae.com Desktop Cloud customer, with goodwill payment arrangements expected by Oct. 30 and compensation application details due by Nov. 6. The company also offered a six-month free alternative cloud service.
The attacker threatened further unauthorized trading at more than 70 securities and FX firms in Japan and abroad, data leaks from connected PCs, ransomware, and publication of internal GMO system details. GMO submitted evidence to Japanese police and declined to comply. OANDA Securities Japan temporarily delayed some withdrawals as a precaution, while AvaTrade Japan confirmed unauthorized access to customer accounts involving external services such as VPS providers, without establishing a direct technical link to GMO in every case.
GMO Internet Group shares fell almost 16% to a four-month low Monday, and the company said it could not yet quantify the earnings impact. Around 200 security staff, including former Interpol personnel, are involved in defense and log analysis through GMO Cyber Security by Ierae and GMO Flatt Security. Kumagai described the incident as a symbol of an “AI cyber saturation attack,” noting that the autonomous AI penetration-testing tool ARTEX was misused against roughly 20 Japanese companies. The extortion demand in Bitcoin and Ether adds a crypto-specific dimension, but GMO said paying would not guarantee that stolen data would not be misused.
