MediumII Cyber Warfare & Critical Infrastructure28 October 2026, Wednesday
GMO puts a $1 million bounty on the hackers behind its breach
On 28 October GMO Internet offered rewards of up to 1 million dollars in total for tips leading to the capture of the attackers who breached its FX trading cloud. When their deadline expired at noon on 27 October, the attackers published data they said belonged to one customer.
According to The Hacker News, the bounty programme opened on 28 October and pays only for tips that lead to an arrest or to an international wanted listing such as an Interpol Red Notice. It closes on an arrest, a wanted listing or 27 October 2027, whichever comes first. GMO will decide whether the reward goes to a single informant or is split. Those involved in the crime and GMO employees are excluded from the 1 million dollar programme.
Finance Magnates reports that the attackers released the material around 12:30 local time on 27 October, half an hour after their noon deadline. As of 13:55 that day, GMO had not confirmed a ransomware attack and had found no malware on customer computers it finished examining by 11:59. The Hacker News says the leak site went offline at around 4 a.m. on 28 October. On 21 October the attacker had demanded about 8 billion yen, or 50 million dollars, by email. GMO refused, saying payment would not guarantee the data's deletion.
According to a Kyodo report carried by Bernama, Finance Minister Satsuki Katayama said on 27 October that five FX firms had reported customer impact to the Financial Services Agency. They include OANDA Japan, Goldenway Japan and Ava Trade Japan. Katayama said new unauthorised trades could not be ruled out. Finance Magnates, citing Bloomberg, reported that no new unauthorised trades had been reported by that day. FXTF, which manages more than 280,000 accounts in Tokyo, blocked MT4 and MT5 logins from overseas IP addresses for all customers on 27 October.
GMO reiterates that 26,739 servers may have been affected and that this is not a confirmed count of intrusions. The company will pay every user 5,000 yen, and customers whose data is confirmed as leaked 10,000-25,000 yen per type of information. It will explain by 6 November how realised trading losses can be claimed.
Talay assessment
Bottom line
The bounty shows GMO closing the door on ransom talks and handing the problem to law enforcement and international cooperation. The 27 October leak was confined to one customer and ransomware has not been confirmed, so the threat is smaller than the 50 million dollar headline suggests. The real risk is that unauthorised trading seen at five firms, using leaked login credentials, spreads to others.
Likely effects
- Retail FX brokersNegativeWeeks
If access restrictions such as FXTF's overseas IP block spread, customer experience suffers and firms face higher compliance and compensation costs.
- Japanese cyber policyUncertain1–6 months
A private firm refusing the ransom and offering a bounty adds pressure for law enforcement and active defence tools in the government's emergency package expected this weekend.
- GMO's balance sheetNegative1–6 months
The 5,000 yen general payment, 10,000-25,000 yen data compensation and the 1 million dollar bounty enlarge the extraordinary loss line.
Possibilities, ranked
- 1Leak stays contained, focus turns to compensation55%
No new large data release follows; attention shifts to the 6 November compensation method and the government package.
Watch: The 6 November compensation announcement and any new filings with the FSA
- 2Attackers publish more data30%
Wider customer data emerges, more than five firms report unauthorised trades and access restrictions spread across the industry.
Watch: The number of FX firms reporting impact rising above five
- 3The bounty pays off15%
A tip leads to an arrest or an international wanted listing, and the wave of attacks slows.
Watch: An arrest or Red Notice announced by Japanese or foreign police
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Bounty ceiling▲ $1 million
- FX firms reporting impact▼ 5
- Servers at risk▼ 26,739