Japan’s GMO Internet Group has taken an unusual step after a cyberattack on one of its services. The company announced a reward of up to $1 million for information that leads to the capture of the hackers who breached its Onamae.com Desktop Cloud service. The announcement follows the company’s decision to refuse the attackers’ extortion demand.

Here is a clear look at what happened, why it matters for people who trade online, and what could come next. For more security news, explore our Cybersecurity section at Jantarax Tech.

What Happened?

According to reports, attackers breached GMO’s Onamae.com Desktop Cloud service and then demanded money. GMO says it declined to pay. Soon after, on October 28, 2026, it launched a reward program to encourage people to come forward with information.

The source material does not explain how the attackers got in, how many customers were affected, or what data or systems they accessed. Those details may emerge as the investigation continues, so check GMO’s official notices for updates.

What Is Onamae.com Desktop Cloud?

The service that was compromised provides remote Windows desktops. These are virtual computers that run in a company’s data center, and users connect to them over the internet.

In this case, the desktops are used for foreign exchange (FX) trading. Traders often rely on them to keep trading software running all day without depending on their own home computer or connection.

That is why the breach has drawn concern. Trading platforms deal with money and sensitive account details, and downtime or unauthorized access can have real financial consequences.

How Does the $1 Million Reward Work?

GMO designed the program to encourage tips that could help law enforcement catch the cybercriminals. The key rules, as reported:

  • The reward can be up to $1 million.
  • It will be paid only if the information leads to an arrest or an international wanted notice.
  • It aims to help police and investigators, not replace them.

A tip that is interesting but does not lead to one of those results would not qualify. The source does not describe how to submit a tip, so look for instructions on GMO’s official website.

Why Did GMO Refuse to Pay?

Refusing extortion is a widely recommended stance, though it is not always an easy choice. This section is general background, not from the announcement. Security experts often warn that paying criminals can:

  • Encourage more attacks on the same company or others.
  • Fail to guarantee that stolen data will be deleted or returned.
  • Fund further criminal activity.

Some organizations pay anyway to restore services quickly or protect customers. Every case is different, and the right choice depends on the situation and the advice of law enforcement.

GMO’s decision, and its public reward, send a clear message that it intends to fight back. As reported, the stance underscores the company’s commitment to cybersecurity and to protecting its users.

Why Does This Matter for Traders and Customers?

If you use remote desktops or cloud services for trading, this story is a reminder to take security seriously. Even if you were not affected, the same kinds of risks can apply to many online services.

Here are practical steps to consider. These are general good practices, not instructions from GMO:

  1. Watch for official notices. Check GMO’s communications for guidance if you use the service.
  2. Change your passwords for the affected service and for any account where you reused the same password.
  3. Turn on multi-factor authentication wherever it is offered.
  4. Review your trading and account history for anything unfamiliar.
  5. Be careful with emails and calls. Attackers sometimes use news of a breach to run phishing scams. Do not click links in unexpected messages.
  6. Keep records. If you notice problems, save screenshots and dates to help support teams and investigators.

The Bigger Picture: Companies Fighting Back Against Cybercrime

Offering a reward is a notable move. Companies and governments sometimes use bounties to encourage tips from people who may know something, such as insiders, researchers, or others who have seen suspicious activity.

It also reflects a harsh reality: cybercriminals can operate across borders, which makes arrests difficult. A reward tied to an arrest or an international wanted notice points to the global nature of the challenge. Investigators may need cooperation from several countries.

Security risks are growing across the industry. Recent examples include the Revolut data breach caused by fake government requests and our TP-Link router ban and state lawsuits, which both show how security failures can affect users and companies alike.

New tools are also changing the defense side. Anthropic, for example, launched a free AI vulnerability scanner for open-source projects, which could help organizations find weaknesses before attackers do.

What Happens Next?

As the investigation continues, GMO’s reward may bring in tips from many sources and could lead to breakthroughs in identifying those responsible. The company is also likely to strengthen its security measures to prevent future incidents and reassure its clients.

Things to watch include:

  • Updates from GMO about the scope of the breach and what customers should do.
  • Any arrests or wanted notices, which would trigger the reward.
  • Security upgrades announced for Onamae.com services.
  • Reactions from regulators or financial authorities, if any.
  • Whether other companies copy the idea of offering public bounties after attacks.

What Could This Mean for the Industry?

How GMO handles this case could set a precedent. If the reward helps lead to arrests, other companies may consider similar programs. If it does not, businesses may rely more on private investigations and cooperation with law enforcement.

Either way, the case shows how seriously financial and technology companies must take cyber threats. Customers are paying attention to how firms respond, not only to whether a breach happens, but also to how openly and firmly they react.

Frequently Asked Questions

What is GMO offering?
A reward of up to $1 million for information that leads to the capture of the hackers.

When did the reward start?
October 28, 2026.

Which service was breached?
GMO’s Onamae.com Desktop Cloud, which hosts Windows desktops used for FX trading.

Did GMO pay the extortion demand?
No. GMO refused to meet the attackers’ demand.

How will the reward be paid?
Only if the tip leads to an arrest or an international wanted notice.

Are customers’ accounts at risk?
The source does not say what data was accessed. Follow GMO’s official guidance and use strong passwords with multi-factor authentication.

Conclusion

GMO’s $1 million reward shows a bold, proactive response to a serious attack. It also highlights the ongoing cybersecurity challenges facing tech and financial companies. The outcome could influence how organizations respond to cyber threats in the future, so it is worth following as the investigation moves forward.

For more updates, learn about Jantarax Tech or contact our team with tips and feedback.