💰 The attackers wanted $1 million by noon on October 27. GMO Internet Group refused, let the deadline pass, and that same evening offered $1 million to anyone who helps catch them.

How the breach happened is covered in our earlier piece on GMO's in-house white-hat hackers, who had flagged problems before the attack. This one is about the bounty, and why so many people in Japan met it with a shrug or a joke.

The same $1 million, pointed the other way

The target was Onamae.com Desktop Cloud, a GMO service that rents Windows servers so retail traders can run forex auto-trading software around the clock. ITmedia reported that, according to group head Masatoshi Kumagai, the attackers first demanded $50 million (about 8 billion yen), due by 5 p.m. on October 21. Later they cut the demand to $1 million, due by noon on October 27, and threatened to publish customer data and launch ransomware attacks if GMO did not pay.

GMO did not pay. At 12:30 p.m. on October 27, it confirmed that the attackers had posted what they called customer information. That evening, in its twelfth notice on the incident, GMO said it will never meet the demands and announced the "GMO Cybercrime Bounty," capped at $1 million in total.

GMO does not link the two figures in its notice. Still, the bounty cap matches the last ransom demand exactly.

What it takes to get paid

The bounty site opened at noon on October 28 and takes tips by email in Japanese, English and Chinese. Tips can be anonymous, but anyone who wants the money must verify their identity before payment.

A tip pays only if it helps lead to an arrest, including one by foreign police, or to an international wanted notice such as an INTERPOL Red Notice. If one person's information does that, that person can receive the full $1 million. If several tips help, the money is split. GMO alone decides who contributed what, and if nobody qualifies, nobody is paid.

Excluded are the attackers and their accomplices, anyone who got the information illegally (buying leaked data counts), anyone who sends unverified AI-generated material, police and other public officials, and staff of GMO Internet Group and its contractors. After an arrest or wanted notice, GMO says it will publish how much it paid for which information and to how many people, without naming them.

The twelfth notice said tips would be accepted until the perpetrator is arrested. The program terms posted the next day add an end date: the program closes at an arrest, an international wanted notice, or 11:59 p.m. on October 27, 2027, whichever comes first.

GMO's "about 150 million yen" is a reference amount at 150 yen to the dollar. At the October 28 rate of about 157.9 yen, $1 million is closer to 158 million yen.

By 6 p.m. on the first day, 113 tips had come in. GMO says it is checking them one by one.

A precedent: Coinbase

On May 15, 2025, the US crypto exchange Coinbase said criminals had bribed a small number of overseas customer support agents to copy customer data, then demanded $20 million. Coinbase refused. Instead it set up a $20 million reward fund for tips that help get the attackers arrested and convicted. It said fewer than 1% of its monthly transacting users were affected.

In late December 2025, CEO Brian Armstrong posted that police in Hyderabad, India, had arrested a former Coinbase support agent and that more arrests would follow. The Register reported that it was unclear whether any reward had been paid, and Coinbase did not answer its questions.

Japan's police have a reward system of their own. Under the National Police Agency's special reward program, the cap is in principle 3 million yen (about $19,000), and no more than 10 million yen (about $63,000) when there is particular need. GMO's bounty is more than 50 times the standard police cap.

Who is supposed to come forward?

Many people online read it as an attempt to make the gang turn on itself. On Hatena Bookmark, a Japanese social bookmarking site, users called it a real-life prisoner's dilemma: sell out your partners and take the $1 million. Others saw it as the best deterrent available, putting bounty hunters worldwide on the attackers' trail.

The rules cut against that reading, because accomplices are excluded. That leaves people close to the gang who took no part in the crime, and outsiders who can tie a server, a domain or a crypto wallet to a real person.

Some argued that anyone holding that kind of information would not risk it for 150 million yen. Others doubted GMO would ever pay, or worried that a tipster's own details might leak. And many raised the point from our first story: GMO already employs white-hat hackers. Under the terms, those employees could not collect even if they found the attackers.

The 3 million yen that doesn't add up

The same notice announced a second payment. For each customer whose published information GMO confirms, it will pay 10,000 yen (about $63) for basic details such as name and contact information, 15,000 yen (about $95) for financial and login data such as trading account IDs and passwords, and 25,000 yen (about $158) for sensitive personal information. This is separate from the flat 5,000 yen (about $32) already promised to every user.

The heading says up to 3 million yen (about $19,000) per disclosure. But all three categories together come to 50,000 yen (about $317), and the notice does not explain how a customer could reach 3 million. On Hatena, users asked again and again how the figures were supposed to add up, and some called the heading a dark pattern. GMO says it may revise the payments if the scale or method of the leaks changes.

TBS News spoke to a woman in her thirties who had lost about 1.2 million yen (about $7,600) to unauthorized trades and said she had barely slept for days.

"Victim No. 1" says they never used the service

On October 27, the attackers' site posted one person's data under the label "Victim No. 1": a photo, name, date of birth, home address, phone number, occupation, family details and more. The attackers said they would publish more every day at noon until GMO paid.

The Yomiuri Shimbun then spoke to the person through a pooled interview, arranged so that crowds of reporters would not descend on the address. According to Shueisha Online, which cited that report, the person said most of the published information was false and that they had never used GMO's cloud service.

Around 4 a.m. on October 28, the site and its mirrors went offline after GMO worked with other companies. GMO says it will move to take down any new site, and it has sent 20 warnings about posts on X that spread the site's address or contents. Its analysis of devices borrowed from customers has so far found no trace of malware or ransomware, though checks continue.

From the start, GMO has warned that the attackers' material may include false information. If "Victim No. 1" was never a customer, it is hard to say how much of the rest is real.

A reward built for a long wait

For now the bounty runs for up to a year, and it pays only when police act, possibly in another country. Coinbase's reward fund is about a year and a half old, and public reports still do not show whether any of it has been paid.

If a company in your country were attacked, would you trust it to run its own manhunt, or would you rather leave that to the police?

References