GMO ransom demands: ¥8 billion vs ¥160 million, and the real hostages
GMO Internet's cloud service for FX trading, Onamae.com Desktop Cloud, was hit by unauthorized access, and the attacker is demanding a ransom. News reports give conflicting amounts such as "¥8 billion," "¥150 million" and "$1 million," and claims such as "GMO paid" and "it was done by Chinese state-linked hackers" are also spreading. Based on GMO's announcements and news reports, we set out what we could confirm, and the views of those who support refusing the demands and those who question user protection and GMO's response.
Verdict: are the viral claims true?
- False“GMO paid the ransom”GMO said it "will not comply with the attacker's demands," and CEO Masatoshi Kumagai also said "no payment whatsoever has been made." On October 27, the attacker also issued a statement saying GMO had not agreed to negotiate.
- Misleading“The ransom demand is ¥8 billion”About ¥8 billion ($50 million) was the first demand, with a deadline of 5 p.m. on October 21, and that deadline has already passed. The demand with a deadline of noon on October 27 is $1 million (about ¥150–160 million).
- False“The ransom was raised from ¥150 million to ¥7.9 billion”The order is reversed. The first demand was $50 million (about ¥7.9–8 billion), and the demand shown on the attacker's site on October 24 is $1 million. The differences in the yen amounts come from currency conversion and rounding.
- True“Personal data was published after the noon deadline”According to NHK and the Yomiuri Shimbun, shortly after noon on October 27 the attacker published one item that appears to be personal data on its site. Whether the data is genuine is unknown, and the attacker said it would keep publishing data every day at noon (as of 13:45 JST on October 27). Since then, GMO has described what was published as material that 'purports to be' information and may contain untrue content, and a person whose name matches has said the content is 'mostly nonsense.' The attacker's site was taken down on October 28 (see Follow-ups).
- Unverified“The attacker can take over users' PCs”The attacker claims so, but GMO said that, as of 11:59 on October 27, no malware, including ransomware, had been found on the users' devices it had finished analyzing. The analysis is ongoing, and that does not mean the devices have been confirmed safe. On October 28, GMO reported that its analysis of the devices it collected had found no malware infection or trace of a ransomware attack, so no evidence supporting the attacker's claim has been found (see Follow-ups).
- Unverified“Chinese state-linked hackers are extorting GMO”GMO, the police and the government have not revealed who the attacker is. The misuse of the Chinese AI tool ARTEX was confirmed by a GMO subsidiary in attacks on about 20 other companies, and no link to this attack has been shown.
- Misleading“The state can neutralize the attacker if GMO asks”The active cyber defense law took effect on October 1, but Chief Cabinet Secretary Minoru Kihara said neutralization measures are decided in light of the law's requirements "regardless of requests from the affected organization." He has not said whether any have been carried out.
Translated and adapted from our Japanese original. Facts are as of the original publication date unless noted.
The GMO extortion case: the ransom amounts, and what "users' PCs held hostage" means
- First demand (deadline October 21)
- $50 million = about ¥8 billion
- Second demand (deadline noon on October 27)
- $1 million = about ¥160 million
- Servers that may be affected
- 26,739
Support refusing the demands
Even if it pays, there is no guarantee the data will be deleted, and the money would fund crime. Refusing the demands is the right policy.
Question user protection and GMO's responsibility
Users' PCs and personal data are being held hostage. GMO should do more to explain, take countermeasures and compensate.
- Both sides agree
- Keeping the harm to users from spreading is the top priority.
- What to watch next
- Further data releases by the attacker, the results of the device analysis, and the government's emergency countermeasures package.
Key points
- On October 20, malicious programs were found on Onamae.com Desktop Cloud, GMO Internet's cloud service for automated FX trading. GMO shut down the servers on all plans on October 21 and says 26,739 servers may be affected.
- Login details for trading accounts and other data stored on the servers were used, and complaints followed one after another of losses from FX trades users did not recognize. On October 27, Financial Services Minister Satsuki Katayama said five FX firms had reported customer harm.
- The attacker demanded $50 million (about ¥8 billion) from GMO on October 21, and on October 24 demanded $1 million (about ¥160 million) on its own site. The amounts in news reports vary because two demands made at different times, and different conversions into yen, are being mixed together.
- GMO did not comply with the demands. It decided to pay all users ¥5,000 as a goodwill payment and to compensate losses from unauthorized trades, and asked the government to apply active cyber defense. Shortly after noon on October 27, the attacker published one item that appears to be personal data, saying GMO had not agreed to negotiate.
1. What is happening
Sorting out the viral claims
| Viral claim | What we confirmed |
|---|---|
| GMO paid the ransom | GMO said it “will not comply with the demands,” and CEO Kumagai also denied making any payment. |
| The demand is ¥8 billion | About ¥8 billion ($50 million) was the first demand, with an October 21 deadline. The demand with a deadline of noon on October 27 is $1 million (about ¥160 million). |
| It was raised from ¥150 million to ¥7.9 billion | The order is reversed; the demand has dropped sharply. |
| Customer data was published at noon | The attacker published one item that appears to be personal data. Whether it is genuine is unknown. |
| Users’ PCs have already been taken over | This is the attacker’s claim. As of 11:59, no malware had been found on the devices GMO had finished analyzing. |
| It was done by Chinese state-linked hackers | The attacker’s identity has not been revealed. |
| GMO Coin’s crypto assets will be stolen the same way | GMO Coin said that, as of October 23, no unauthorized operations had been confirmed on its own accounts. |
*Information checked as of 13:45 JST on October 27.
Why do the amounts vary?
| When | What was demanded | Source | How reports put it |
|---|---|---|---|
| October 21 (deadline 5 p.m.) | $50 million in crypto assets | GMO’s announcement (7th update) and CEO Kumagai’s blog | About ¥8 billion (GMO, Jiji, TV Asahi); about ¥7.9 billion (Asahi, Nikkei, Bloomberg) |
| Made public October 24 (deadline noon on October 27) | $1 million | The attacker’s site (according to reports) | Just over ¥157 million (NHK); about ¥160 million (Yomiuri, ITmedia, TV Asahi); just over ¥150 million (TBS) |
Some articles, such as Jiji Press’s headline “¥8 billion demanded, customer data to be published at noon on the 27th,” put the October 21 demand together with the October 27 deadline, which is one cause of the confusion. Articles reporting that GMO “refused $50 million (about ¥7.9 billion)” also refer to the first demand on October 21.
What happened (timeline)
- October 19: GMO begins investigating after inquiries from users
- October 20: Malicious programs confirmed on some servers
- October 21: Servers on all plans shut down. The same day, about ¥8 billion is demanded in extortion emails
- From October 21: Reports of FX trades users did not recognize follow one after another. GMO consults the police on October 22
- October 24: GMO announces a ¥5,000 goodwill payment and compensation for losses, and asks the government to apply active cyber defense. The attacker demands $1 million on its own site
- October 25–26: In his blog, CEO Kumagai acknowledges that issues had been pointed out internally in advance, and makes the demand amount public. GMO begins taking in users’ devices for analysis
- October 27: Before noon, GMO calls on users to back up their data and then turn off their PCs. Shortly after noon, the attacker publishes one item that appears to be personal data
What are “double extortion” and “users held hostage”?
- Conventional ransomware: Encrypts a company’s data and demands money in exchange for restoring it
- Double extortion: Steals data and threatens to “publish it unless you pay.” According to the National Police Agency, most current harm comes from this method
- What is different this time: The attacker sent emails directly not only to the company but also to users, and announced attacks on users’ PCs and the publication of data. It is a method that draws in victims and public opinion to increase pressure on the company
What users are being asked to do
GMO is asking users to do the following for PCs and smartphones that connected to Desktop Cloud.
- Run a “full scan” with antivirus software
- Back up important data to an external storage device disconnected from the network
- From a separate, safe device, change passwords for FX, securities, email and other accounts, and set up multi-factor authentication
- Do not respond to contacts asking for fees, such as offers to “recover your lost money”
GMO says it will provide a new PC with equivalent performance to users who suffered ransomware damage. Some experts’ analysis also found that the extortion site had a built-in mechanism to record visits, so it is important not to go and look at it carelessly.
A series of data leaks
Around the same time, Rakuten Travel (up to about 2.6 million records), Joshin (up to 6.23 million records) and others also announced that customer data may have leaked through unauthorized access. Among the reports we checked, the GMO case is the one in which the attacker has stated amounts publicly and is directly threatening even users.
Sources (mostly in Japanese)
2. What each side says
We summarize each side's main arguments in our own words, based on the original statements and reporting.
Support refusing the demands
GMO said it "will not comply with the attacker's demands," explaining that "complying with the demands does not guarantee the deletion of the obtained information or the prevention of its misuse." It has submitted evidence of the extortion, such as communication records, to the police and asked for a criminal investigation.
The National Police Agency tells victims that paying a ransomware ransom raises concerns that the money will fund criminal groups, and that it does not guarantee data will be recovered. It says double extortion, in which attackers steal data and threaten to publish it unless paid, accounts for most of the harm.
An expert at Macnica told the Asahi Shimbun that the attacker in this case is trying to win the public over and use it as pressure on the company. The expert said visiting the extortion site or spreading its content plays "exactly into the attacker's hands" and urged people not to spread it.
Question user protection and GMO's responsibility
In a blog post, CEO Kumagai acknowledged that in-house white-hat hackers had pointed out issues to fix in advance, but that the depth and speed of the response were not enough and "the gap was exploited." ITmedia NEWS reported that criticism followed on social media, such as that he was turning the company's lack of measures into a problem for the whole country.
The attacker claims as GMO's "negligence" that there was an administrator account shared across all servers, and that by default the server side could see the drives of the users' PCs connected to it. GMO has not disclosed details of the vulnerability, and it is not known whether the claims are correct.
Tokyo Sports Web reported that users were saying things like "having the data made public is the bigger problem" and pushing back against the ¥5,000 goodwill payment, and that distrust of GMO was growing more than of the attacker. A man who said he lost about ¥2.4 million through unauthorized trades told the Yomiuri Shimbun he was also considering replacing his PC.
The government's response
Chief Cabinet Secretary Kihara said neutralization measures under active cyber defense are decided by the police and the Self-Defense Forces in light of the law's requirements, "regardless of requests from the affected organization," and declined to comment on individual responses, saying doing so would inform the attacker. Some point out that the law assumes serious attacks on the state and critical infrastructure, and that applying it after harm has already occurred is problematic.
On October 27, Financial Services Minister Katayama said five FX firms had reported customer harm believed to be related to GMO. The firms have taken steps such as temporarily suspending trading by the affected customers and blocking unauthorized orders from overseas, and say no new unauthorized trades have been reported.
Reading between the lines
This section is our editors' interpretation (speculation). It is not confirmed, but the facts it is based on are sourced.
The attacker
Why threaten users directly, not just the company?
SpeculationOrdinary ransomware threatens a company by encrypting or stealing its data, but in this case the attacker sent emails directly to users and is using even users' PCs and personal data as leverage. The aim appears to be to increase pressure on the company to pay, through victims' anxiety and public opinion. Sharply lowering the demand from about ¥8 billion to $1 million may also have been meant to make payment easier to extract, but the reason is not known.
Facts this is based on
- • Emails were sent to victims by a person believed to be the attacker, and experts see it as "aimed at increasing pressure on the business and leading to a demand for money"Asahi Shimbun (Targeting customer assets, pressure on the company, Japanese)(Oct 23)
- • The attacker has set up an extortion site and keeps up a theatrical style of crime, sending emails directly to victims as wellAsahi Shimbun (Spreading the extortion plays into the attacker's hands, Japanese)(Oct 26)
GMO
Why did it ask the government for active cyber defense?
SpeculationCEO Kumagai argues that a situation in which users' financial assets and personal PCs have been taken hostage should not end as "a single private-sector case." With the company unable to stop the attacker on its own, the aim appears to have been to seek the state's involvement and show it was protecting users. On the other hand, a public request from a company outside the scope of the law is unusual, and it also drew criticism that GMO was shifting responsibility.
Facts this is based on
- • CEO Kumagai said he understood that GMO is not a specified critical infrastructure operator as defined by law, but asked that its application be considered in light of the impact on people's livesSankei News (full text of CEO Masatoshi Kumagai's blog post, Japanese)(Oct 26)
- • In its 4th update on October 24, GMO positioned the case as the first case to trigger active cyber defense and put this to the governmentGMO Internet (4th update; goodwill payment, compensation and request for active cyber defense, Japanese)(Oct 24)
What people are saying
We searched X (formerly Twitter) for terms such as "GMO ransom," "GMO if they pay," "GMO won't give in" and "GMO should pay," and checked Japanese posts from October 23–27, 2026. Many posts simply spread the attacker's claims and demand amounts, and few posts gave an opinion on whether to pay
Support refusing the demands
- “I think refusing a huge demand is right, as a principle of not giving in to cyberattacks.”
Question user protection and GMO's responsibility
- “It's terrible that even children's data is being published. For about ¥150 million, I think they should have just paid right away.”
- “What matters is when GMO knew about the problem. If they left it alone, I think their responsibility is heavy.”
- “Management is judged on results, so I think the CEO should take responsibility and resign.”
Posts are paraphrased, not quoted, and individual accounts are not named.
3. Where things stand
Where they agree
- GMO has not paid a ransom so far.
- Users need to hurry with measures they can take themselves, such as changing passwords and checking their devices.
Where they disagree
- Whether GMO should consider negotiating or paying to prevent the publication of users' data.
- Whether a ¥5,000 goodwill payment and compensation for losses are enough.
- Whether it is appropriate for a private company to ask the government to apply active cyber defense.
What to watch
- Whether the data releases the attacker announced for every day at noon continue.
- The results of GMO's device analysis, and its explanation of the system's flaws.
- The government's emergency countermeasures package, and how active cyber defense is operated.
GMO has not paid a ransom and continues its policy of not complying with the demands. The amounts in news reports vary because two demands are being mixed together: $50 million (about ¥8 billion) with a deadline of October 21, and $1 million (about ¥160 million) with a deadline of noon on October 27. After the deadline, the attacker published one item that appears to be personal data, but whether any attack on users' PCs has actually taken place could not be confirmed as of 13:45 JST on October 27. Those who support refusing the demands believe that paying would not guarantee the data is deleted and would fund crime. Those who question user protection and GMO's responsibility say users were taken hostage as a result of leaving issues unaddressed that had been pointed out in advance, and call for better explanations and compensation.
4. What happened next
Updates added after this article was published.
GMO announces special payments and a bounty; Tokyo police investigate
On October 27, GMO announced that at 12:30 it had confirmed that a person believed to be the attacker had published material described as information about GMO and its users. It said the material may contain things that are not true and asked people not to access or spread it. It said no ransomware attack had been confirmed as of 13:55. That evening, saying it would "never" comply with the attacker's demands, GMO announced a "special goodwill payment" of up to ¥3 million per publication, depending on the type of information, for users whose own information is found in the published material. It also set up a bounty capped at a total of $1 million (about ¥150 million) for information leading to the identification of the culprits or the solving of the case. The Tokyo Metropolitan Police Department is investigating with possible violations of the Unauthorized Computer Access Act and other laws in view.
Attacker's site taken down; no trace of malware found on devices
On October 28, GMO announced it had confirmed that around 4 a.m. Japan time the domain of the attacker's site that had carried the information was suspended. According to the Yomiuri Shimbun, the domain was suspended by the U.S. company that manages it, at GMO's request. According to Jiji Press, the site had not been updated as of noon on October 28. On October 27, a person whose name and other details match the published information told a pool of reporters that the content was "mostly nonsense" and said they had never used GMO's FX servers. On the evening of October 28, GMO reported that analysis of the users' devices it had collected had found no malware infection or trace of a ransomware attack. Detailed investigation is continuing.
GMO Internet (13th notice: suspension of the culprit's site domain confirmed, Japanese)(Oct 28)GMO Internet (14th notice: bounty tips and status of device analysis, Japanese)(Oct 28)Jiji Press (GMO confirms the attacker's site has stopped, Japanese)(Oct 28)Yomiuri Shimbun (Ministry asks telecoms to block the GMO attacker's site, Japanese)(Oct 29)GMO hands police a strong lead; government asks for site blocking
On October 29, GMO announced that its group's white-hat hacker team had, through its own investigation, obtained information it believes will lead to identifying the culprit, and that it would submit it to the police and others that day. As of 6 p.m. on October 29, 321 tips had been sent to the bounty desk. It also emerged that on October 27 the Ministry of Internal Affairs and Communications had sent a written request to four telecom industry groups, including one whose members include NTT and KDDI, to "block," that is, forcibly cut off, connections to the attacker's site. Blocking risks infringing the "secrecy of communications" guaranteed by the Constitution, and the request itself is unusual. Telecom companies have not said whether they carried it out.
Communications minister declines to comment on the blocking request; bounty tips reach 428
At a press conference on October 30, Internal Affairs and Communications Minister Hisayuki Fujii was asked whether the ministry had asked telecom carriers to block connections to the attacker's site. He said he would "refrain from answering" because the case is ongoing. On October 29, several major carriers had said their industry groups received such a request. GMO said on October 30 that its bounty desk had received a total of 428 tips as of 6 p.m. It says it is checking and examining each one.