TOKYO (TR) – Tech conglomerate GMO Internet Group is refusing to bow to a hacker syndicate demanding a $1 million ransom following a devastating cyberattack on its foreign exchange (FX) trading servers that compromised customer data and led to unauthorized trades, reports NHK (Oct. 27).
The shadowy hacker group issued an ultimatum, demanding the company pay $1 million (approx. 157 million yen) by noon on Tuesday. The syndicate threatened to publish users’ personal data on the dark web and infect customers’ personal computers with ransomware if the tech giant fails to pay up.
“We will not respond to demands from attackers,” GMO stated. The company instead issued an “urgent request” urging its users to immediately run full virus scans on their devices and back up their data.
FX trading
The breach targeted cloud servers used for automated FX trading. Hackers bypassed security, stealing customer information and executing unauthorized transactions. Beginning around the 21st, the hackers began emailing terrified users directly, boasting that they had destroyed 17% of customer accounts—wiping out an estimated 7.7 billion yen in assets—as punishment for GMO’s initial refusal to negotiate.
The ensuing panic triggered a massive sell-off on the Tokyo Stock Exchange, sending GMO shares plunging by over 15% on Monday as investors reacted to the catastrophic security failure.
GMO consulted police on the 22nd after confirming that trading passwords had been exposed. The company reported that over 26,000 servers may have been compromised in the attack.
“White hackers”
On Monday, GMO President Masatoshi Kumagai took to his personal blog to reveal that the syndicate’s extortion attempts went even further. Hackers had sent a document demanding a staggering $50 million (approx. 8 billion yen) payable in Bitcoin or Ethereum by October 21, 2026.
In a stunning admission, Kumagai confessed that the company’s internal “white hackers” had previously warned management about the specific vulnerabilities used in the attack. However, fixes were delayed to prioritize service availability.
“Our depth and speed of response were insufficient, and the attackers exploited that gap,” Kumagai wrote. “I deeply regret that we could not perfectly translate our experts’ knowledge into an effective defense.”
Overwhelmed by the scale of the extortion, GMO has made an emergency request to the Japanese government for “active cyber defense,” stating that it is impossible for a private enterprise to fight off an international cybercrime syndicate alone.
The company has pledged to compensate users for their financial losses and will distribute a flat 5,000-yen condolence payment to all customers.
