GMO Offers Up to $1 Million Bounty After FX Trading Cloud Breach

Japan's GMO Internet Group has opened a bounty program offering up to $1 million in total for tips that help catch the attackers behind the breach of its Onamae.com Desktop Cloud service, after refusing an extortion demand. The program opened on October 28 and pays only if a tip leads to an arrest or an international wanted notice. The service hosts Windows desktops used for FX trading, and a broker has linked unauthorized trades on some customers' accounts to logins leaked from the service.

Bounty Terms

GMO runs and pays for the program, called GMO Cybercrime Bounty. Tips are sent by email to an address on a dedicated website, in Japanese, English, or Chinese, and can be anonymous. The program is open until an arrest, an international wanted notice, or October 27, 2027, whichever comes first. GMO wants information linking people, servers, domains, IP addresses, accounts, or cryptocurrency addresses to the attack, extortion, or money movement.

A tip earns money only if it leads to an arrest, including outside Japan, or an international wanted notice such as an Interpol Red Notice. GMO decides how much each tip helped, and one tipster can receive the full $1 million or the total can be split. Tipsters must prove identity before payment. GMO warns tipsters not to break into systems, negotiate with or pay attackers, or send leaked data or malware.

Breach and Trading Impact

GMO Internet, the subsidiary running the service, found on October 20 that a third party had installed malicious programs on some customers' servers. It shut down servers on every plan from October 21. It counts 26,739 servers as potentially affected, not as confirmed break-ins or data thefts. On October 24, GMO confirmed a security problem, unauthorized access, and exfiltration of customer information. Anything stored on the servers may have been viewed, including login credentials saved in MetaTrader 4 and 5 (MT4/MT5).

Customers began reporting unrecognized trades on October 21. OANDA Japan confirmed a third party logged in to and traded on some of its customers' accounts using ID and password pairs it believes were leaked from GMO servers. It restricted trading on possibly affected accounts and had not found a break-in in its own core systems as of October 26. GMO said in an October 28 filing that it had not confirmed how many customers payments will cover or which trades qualify for compensation.

Threats and Customer Advice

GMO says attackers threatened to keep manipulating customers' accounts at more than 70 securities and FX firms, publish information about the service and customers' PCs, hit those PCs with ransomware, and publish details of GMO's systems. They set noon on October 27 for releasing customer information and launching ransomware. No ransomware attack had been confirmed as of 1:55 p.m. Japan time that day. GMO says attackers collected information about anyone who visited their site and tells visitors to run a full antivirus scan.

As of October 28, GMO had not said how attackers got in. Masatoshi Kumagai, who heads GMO Internet Group, wrote in an October 25 blog post that the group's white-hat hackers had warned the service team about problems in advance. The response was neither fast nor thorough enough, he wrote, and attackers used the gap. GMO told customers to change trading passwords from a device not used for FX trading, end every logged-in session, check trading history, turn on two-factor authentication where offered, run a full antivirus scan, and back up data.

GMO Internet will pay every current user ¥5,000 and cover actual trading losses and fees from trades it confirms were unauthorized and caused by the breach. Customers whose information it confirms was published will also get ¥10,000 to ¥25,000 for each type of information exposed.

Earlier coverage: GMO Internet warned that its FX trading cloud had been hacked; the attacker is demanding $50 million

Sources: The Hacker News