GMO Internet Confirms Data Leak After Refusing $50M Ransom Demand

Key points

• GMO Internet confirmed that data belonging to the company and its customers was published online on October 27, 2026.
• The breach of the Onamae Desktop Cloud service potentially affected 26,739 customer servers, with malware possibly installed on some systems.
• GMO refused to pay an $8 billion ($50 million) ransom demand, stating it would not comply due to the inability to guarantee data deletion.
• The company urged customers to disconnect their PCs from the internet and unplug cables before noon on October 27 to prevent potential ransomware activation.
• GMO launched a 'Cybercrime Bounty' program offering up to $1 million for information leading to the identification and arrest of the hackers.
• Customers are being offered ¥5,000 ($30) for inconvenience, with additional compensation under consideration for those whose personal information was exposed.

Background

This incident follows earlier reports in late October 2026 regarding the compromise of GMO Internet’s Onamae.com Desktop Cloud service. Previous coverage indicated that the breach led to unauthorized foreign exchange trades and that CEO Masatoshi Kumagai admitted the firm had ignored internal security warnings due to slow response times. The current escalation marks the transition from a potential threat to a confirmed data leak, intensifying the standoff between GMO and the threat actor.

How outlets are covering it

BleepingComputer reports that GMO confirmed the publication of data but noted that no ransomware was actually activated on customer machines, suggesting the threat may have been a bluff or failed execution. The Japan Times emphasizes the ongoing standoff, highlighting the hacker group’s vow to continue leaking information daily until GMO pays the ransom. Japan Today focuses on the proactive measures taken by GMO, including the launch of a $1 million bounty program and the involvement of the Japanese government, with Finance Minister Satsuki Katayama urging financial institutions to defend against potential cyberattacks. While all sources agree on the refusal to pay the ransom, they differ in emphasis: BleepingComputer highlights the lack of ransomware activation, The Japan Times focuses on the leak’s continuation, and Japan Today details the bounty and government response.

Why it matters

The breach highlights the risks associated with virtual private server (VPS) providers used for high-value activities like foreign exchange trading. The incident underscores the importance of rapid incident response and the potential for data leaks to escalate even when ransom demands are refused. The involvement of major financial institutions and the Japanese government indicates the broader economic and regulatory implications of such cyberattacks.

What to watch

GMO will continue to scan customer systems to determine if malware is present and will notify users individually by email once countermeasures are identified. The company will monitor the authenticity of leaked information and may provide additional compensation to affected customers. The 'Cybercrime Bounty' program will remain active until the perpetrators are arrested, and GMO will pursue legal action against those who disseminate the exposed information.