GMO Offers $1 Million Bounty After Onamae.com Cloud Breach

Summary

GMO Group reports unauthorized access to up to 26,739 virtual servers, stolen customer data and unauthorized trades. It is offering up to $1 million for information identifying those responsible; attackers’ claims about how they accessed the systems remain unverified.

Key points

GMO Group said attackers accessed up to 26,739 virtual servers, stole data and made unauthorized trades; customer MetaTrader 4 and 5 credentials may also have been compromised.
The company suspended Onamae.com Desktop Cloud after detecting unauthorized access and receiving an 8 billion yen ransom demand; the extortionists later said they would accept $1 million.
GMO said it has not disclosed how the breach occurred. The attackers claimed they exploited an RDP flaw and used configurations and an exposed administrator password to move between virtual servers.
Attackers threatened to deploy ransomware on customers’ home PCs, but GMO later reported that they did not appear to have followed through.
The extortionists began leaking customer details. GMO said it had not verified whether all leaked information was genuine and reported that the leak site and mirrors had been taken down, though new versions were being attempted.
GMO refused to pay and offered up to $1 million for information leading to the attackers’ identification; it said it had received more than 100 tips by Wednesday.
GMO is working with police and Trend Micro, urged customers to scan and back up their PCs, and offered compensation to affected customers.

Article Details

Victim Organization: GMO Group
Victim Domain: Onamae.com
Incident Type: Unauthorized access, unauthorized trading, data theft, and extortion; attackers also threatened ransomware deployment on customers' home PCs.
Data Types Exposed: GMO Group said data was stolen and that customer credentials for MetaTrader 4 and MetaTrader 5 may have been compromised.
Attackers claimed to have stolen authentication information, email addresses, account balances, browsing history, and data from customers' home PCs; GMO Group had not verified whether all leaked information was genuine.
Affected Records: Up to 26,739 virtual servers were reportedly accessed. The number of affected customer records was not disclosed.
Affected Data Size: Not disclosed
Operational Impact: GMO Group suspended Onamae.com Desktop Cloud on Oct. 21. The company reported unauthorized transactions and said attackers threatened ransomware deployment on customers' home PCs, but did not appear to follow through on that threat.
Ransom Or Extortion: Attackers initially demanded 8 billion yen and later reportedly reduced the demand to $1 million. GMO Group said it would not pay. Attackers began leaking customer details, but GMO Group had not verified whether all leaked information was genuine.
Claim Status: confirmed