GMO offers ¥150 million bounty after reported data release

The Japanese internet group says it will never meet the attackers' demands, as experts describe escalating public threats designed to increase pressure.

Channel: Nippon TV News ·

JapanStory of October 28, 2026Trari Newsroom

Why this story? One of 日テレNEWS's most watched videos since yesterday, with 215,433 views.

日テレNEWS: The news division of Nippon TV, a Japanese commercial television network. 3.4M subscribers and 6.3B views.

【“劇場型”手口】GMO標的｢要求には永久に応じない｣　懸賞金1.5億円、攻撃者の狙いは？

Things we can learn from the video

Press to jump

0:26GMO announces relief payments and a cybercrime bounty totaling about ¥150 million.
3:23GMO confirms publication of purported customer and company information after the attackers' noon deadline.
5:43Proofpoint Japan's Yukimi Masuda explains how ransomware groups escalate threats to pressure their targets.
6:35Katayama reports customer harm at five foreign-exchange firms, but no reports of newly occurring unauthorized transactions.
7:53Kobayashi describes a roughly ¥8 billion ransom demand and GMO's refusal to comply.
10:40The closing discussion examines risks of spreading exposed information and difficulties in taking attackers' websites down.

GMO Internet Group has offered a cybercrime bounty of about ¥150 million after attackers published material purportedly containing customer and company information, according to Japan's Nippon Television News. The company says it will never comply with their demands.

The October 27 news zero report follows the deadline set by attackers who had threatened both a data release and a ransomware attack. GMO said it confirmed the publication of purported information shortly after 2 p.m., following the noon deadline. Its notice urged people not to spread the material.

The report shows staff checking GMO's homepage as the deadline approaches. An on-screen company notice identifies unauthorized access involving its Onamae.com Desktop Cloud service. Alongside the bounty, GMO announced special relief payments capped at ¥3 million per disclosure.

Nippon Television commentator Fumi Kobayashi describes a ransom demand of roughly ¥8 billion. The report's central question is why attackers make their threats so public. Yukimi Masuda of cybersecurity company Proofpoint Japan explains that ransomware groups typically apply pressure repeatedly, rather than issuing a single demand. The staged deadlines and threatened disclosures are presented as part of that escalating coercion.

Financial services minister Satsuki Katayama says five foreign-exchange firms have reported customer harm. She also says officials have received no reports of newly occurring unauthorized transactions, an important distinction from the damage already reported.

Chief Cabinet Secretary Minoru Kihara urges people not to amplify the breach by circulating exposed information. Recalling the 2022 attack on Australian health insurer Medibank, the broadcast examines potential penalties for using leaked material or making threats with it. Its closing discussion also addresses the difficulty of taking such sites down through police powers.

There was a further development overnight. In a separate October 28 update, the broadcaster reports GMO's announcement that a website operated by the suspected attackers had become inaccessible after its domain was suspended around 4 a.m., following coordination with relevant companies and agencies.

Published on Trari