GMO Internet Group Offers $1M Bounty in Desktop Cloud Breach
The group is seeking information on the unauthorized access to its Desktop Cloud service and will pay affected users up to 3 million yen per data publication.
GMO Internet Group announced on October 27, 2026, a bounty program with an overall cap of 1 million US dollars (about 150 million yen) for information on the unauthorized access to its Desktop Cloud service, according to news.denfaminicogamer.jp. Information intake opens at 12:00 on October 28 through a dedicated window in Japanese, English and Chinese, for individuals and companies in Japan and abroad.
The intake period will last until the perpetrator is arrested. Eligible information includes the identity and location of those involved, the servers and accounts used in the attack and in threats, and money flows, the company said.
GMO stated that the bounty pays for lawful cooperation with investigators and is not a ransom or a purchase of stolen data. The group said it has received threats from the perpetrator demanding money while promising unauthorized operation of users' transaction accounts and publication of information.
The company also announced a special condolence payment — GMO Special Condolence Payment — for users whose own information is confirmed to have been published, capped at 3 million yen per publication. The tiers are 10,000 yen for basic information such as name and contact details, 15,000 yen for financial and authentication information such as account IDs and passwords, and 25,000 yen for highly private sensitive information.
According to GMO, that special payment is separate from the uniform 5,000 yen condolence payment announced in its earlier fourth notice, which followed the unauthorized access on October 21, 2026, and from compensation for losses from fraudulent transactions.
Quick answers
How large is the total bounty pool?
GMO Internet Group set an overall cap of 1 million US dollars, about 150 million yen, across all payouts.
When and in what languages can information be submitted?
Intake starts at 12:00 on October 28, 2026, through a dedicated window in Japanese, English and Chinese, and continues until the perpetrator is arrested.
What payments are offered to affected users?
Users whose information is confirmed published can receive up to 3 million yen per publication, tiered at 10,000, 15,000 or 25,000 yen depending on the type of data. This is separate from the 5,000 yen condolence payment already announced.