Serviço de VPS em nuvem do GMO Internet Group… · Breach

GMO refuses $50 million ransom, offers $1 million bounty

Oct 26, 2026 · 1 min read

Attackers breached GMO Internet Group's cloud VPS service used by foreign-exchange traders, stole customer data and credentials, and executed unauthorized trades across over 70 brokerages, according to reports. The attackers demanded $50 million; GMO refused to pay and now offers up to $1 million for tips identifying them. Customers should review account activity and change credentials.

By HIFY Radar newsroom Updated 10/28/2026 04:17 AM Get this every day →← Back to the feed 3 sources

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Attackers breached the servers of GMO Internet Group's cloud VPS service used by foreign-exchange traders. They stole customer data and credentials and executed unauthorized trades in customer accounts. The attackers demanded $50 million; GMO refused to pay and is offering up to $1 million for information that helps identify them.

Why it matters

Customers of the service had credentials stolen, and balance-destroying trades hit over 70 brokerages, according to a report. The case reached the Japanese government: PM Sanae Takaichi is holding an emergency meeting with ministers after a wave of attacks on Japanese companies, according to a report citing Bloomberg. Financial operations that rely on credentials held on third-party VPS face the same kind of damage.

What to do

Review trades and balances in accounts linked to the service and change all credentials immediately. Check whether the company uses third-party VPS for trading and add strong authentication and trade limits. Follow GMO's official announcements on the case.

For the technical team

Affected: Serviço de VPS em nuvem do GMO Internet Group usado por traders de câmbio · GMO Internet Group's cloud VPS service used by FX traders. No specific versions or components cited in the sources.
Exploitation: Exploitation confirmed and reported: server breach, theft of customer data and credentials, and unauthorized trades. One report cites balance-destroying trades across over 70 brokerages. No CVE, PoC, or KEV listing cited in the sources.
Fix: No fixed version or patch cited in the sources; the breach does not stem from a disclosed software flaw. Mitigation for customers: change credentials and review account trades. GMO has engaged Japanese government agencies and offers up to $1 million for tips on the attackers.
Vector: Servers of GMO Internet Group's cloud VPS service for foreign-exchange traders. The initial entry vector is not described in the sources. Attackers breached the servers, stole customer credentials, and used the leaked credentials to execute unauthorized FX trades.
More details: Attackers demanded $50 million and GMO refused to pay, per the company's disclosure. According to a report citing Bloomberg, PM Sanae Takaichi is holding an emergency meeting with ministers after several cyberattacks on Japanese companies, and Japan brought in new laws less than a month ago letting it hunt hackers before they strike. Timeline: breach and government engagement reported on 2026-10-26; ransom refusal and bounty disclosed on 2026-10-28.

Timeline

10/28/2026 04:17 AM
GMO says the attackers demanded $50 million, refused to pay, and is now offering up to $1 million for tips to catch them.
10/26/2026 02:44 PM
New reports say attackers breached the FX-trader VPS servers, stole customer credentials and executed balance-destroying trades across more than 70 brokerages; GMO has asked government agencies for help.
10/26/2026 01:55 PM
Incident opened.