Japanese IT conglomerate GMO Internet Group has announced a reward of up to $1 million for information leading to the identification of hackers involved in unauthorized access to the company's cloud services. The decision comes amid an ongoing data breach incident involving client accounts managed through a cloud platform that facilitates automated foreign exchange trading and other transactions. GMO stated that the company will never meet the attackers' demands and intends to hold those behind the attack publicly accountable.

Attack Timeline and Ransom Demand

According to the company, unauthorized third-party access to its cloud service was detected last week. During the same period, GMO reported unauthorized transactions on several client accounts. The hacking group claiming responsibility for the attack demanded a $1 million ransom by noon on October 27, threatening to leak client data if the demand was not met. On the afternoon of October 27, the group reportedly posted personal user information online, claiming the company had missed the deadline.

Confirmed Personal Data Leak

GMO confirmed that information presumed to contain client personal data has been posted online. The company urged the public not to publish or share this information on social media or other channels to prevent its further spread. Thus, part of the data leak has been acknowledged by the company itself, not just the hackers, confirming the incident from both sides.

Victim Compensation and Management Stance

On the evening of October 27, announcing the bounty plan, GMO stated it would pay each affected user compensation of up to 3 million yen (approximately $19,000) for each data breach incident involving their information. At the same time, the company emphasized that it has no intention of yielding to the attackers' demands and views the up to $1 million reward as a tool to identify those responsible for the attack rather than a settlement form.

Client Risks and Further Threats

Despite this stated position, hackers have threatened to publish additional client details, raising concerns among platform users. For cloud forex service clients, this means an increased risk of repeated leaks and potential financial losses, while for the company, it entails conducting investigations, compensating for damages, and curbing the further spread of already published data simultaneously. The situation remains fluid, and GMO's next steps will depend on the results of internal and external investigations into the incident.