Japanese tech firm offers $1 million to catch hackers who hit trading service

Japan's GMO Internet Group is offering up to $1 million for tips that help catch the hackers who broke into its Onamae.com Desktop Cloud service. The company refused to pay the attackers, who demanded about $50 million. The reward program opened on October 28.

What happened

The service rents out Windows desktops that people use for foreign exchange (FX) trading. On October 20, GMO found that an outsider had installed malicious programs on some customers' servers. It shut down servers on every plan starting October 21. It counts 26,739 servers as potentially affected. That is not the number of confirmed break-ins.

On October 24, GMO confirmed that customer information had been taken. The attackers sent their $50 million demand on October 21. They also threatened customers' trading accounts and data. On October 28, GMO had the attackers' website and its mirror sites shut down.

How the bounty works

• Tips go by email, in Japanese, English or Chinese, and can be anonymous.
• Money is paid only if a tip leads to an arrest or an international wanted notice.
• GMO decides how much each tip helped, so the $1 million may be split.
• The program runs until an arrest, a wanted notice, or October 27, 2027.

Who it affects

Customers who stored anything on the servers may have had it viewed. That includes logins saved in trading software such as MetaTrouter 4 and 5.

Customers who stored anything on the servers may have had it viewed. That includes logins saved in trading programs MetaTrader 4 and 5. GMO says it does not keep customers' payment card data on the servers.

Brokers are involved too. OANDA Japan confirmed that a third party logged in and traded on some customers' accounts, using ID and password pairs it believes leaked from the GMO servers. It restricted trading on possibly affected accounts. FXTF also warned its customers.

What is not known yet

GMO has not said how the attackers got in. It has not confirmed how many customers its payments will cover, how much information was published, or which trades qualify for compensation. The attackers made claims about shared administrator accounts and a flaw that reached customers' own PCs. GMO had not publicly confirmed those claims.

What to do

GMO asks people not to visit the attackers' site or repost its material, and says the site collected information about visitors. FXTF told customers who had used Desktop Cloud to change their passwords from a device that had never connected to it. Use a unique password for each account, and watch your accounts for trades or logins you do not recognize.