GMO Posts $1 Million Bounty as Japanese Brokers Force Two-Step Logins

GMO Internet Group put up to $1 million on the table Wednesday for information leading to the identification and arrest of the hackers who breached its trading server service. The site where the attackers had published customer data went offline early the same day, after GMO worked with other companies to suspend the domain at about 4:00 local time.

The attackers began publishing what they claimed was customer data on Tuesday, after GMO refused a demand of roughly ¥8 billion — about $50 million. GMO says it will move to take down any copies that appear elsewhere. The company stated plainly: it "will never comply with the attacker's demands," and it is working with police. It funds the bounty itself and began taking tips at noon.

What changes for brokers and clients?

Brokers hit by the breach are tightening logins for every client, not just those who rented GMO's servers. FXTF, which runs more than 280,000 accounts out of Tokyo, will lock clients out of its portal and platform from Saturday unless they switch on two-step login.

FXTF already required one-time passwords on MT4 and MT5. Today's notice extends the rule to its client portal and the FXTF GX platform after weekly maintenance on October 31, and removes the option to close the setup window. Codes go to the registered email address, so clients whose inbox cannot receive them get shut out. FXTF, one of five brokers that confirmed unauthorized trades by Monday, becomes GW Securities on November 1.

Dukascopy Japan said today that some clients who used the GMO service had trades placed without consent. It changed passwords on accounts with suspected unauthorized logins and ended every open session. The broker found no sign its own systems were accessed.

OANDA Japan told clients on Tuesday it is strengthening MT5 login security. It asked those on rented servers to change the default remote desktop port and restrict which IP addresses can connect. OANDA plans to switch off MT4 on November 27.

There's precedent. XTB took the same step in Poland last year, making two-step login compulsory for all clients hours after a customer said hackers had drained his account through rapid trades in thinly traded stocks.

How much will the breach cost GMO?

In a filing to the Tokyo Stock Exchange today, GMO listed six kinds of payment linked to the breach:

• ¥5,000 for every user of the service;
• repayment of realized losses from unauthorized trades;
• a new PC for any customer hit by ransomware;
• ¥10,000 to ¥25,000 for each category of information exposed, for customers whose data GMO confirms was published;
• a cap of ¥3 million per disclosure.

GMO said the total cannot be calculated until it knows how many customers qualify and what the published data covers. It has not said how many customers had data published. Up to 26,739 servers may have been exposed, the company said last week.

Is the market punishing GMO?

Not this week. GMO Internet Group shares closed 5.2% higher than on Tuesday at ¥3,324, recovering part of a 15.7% fall on Monday.

The political pressure is building anyway. Prime Minister Sanae Takaichi has asked her cabinet for emergency measures against cyberattacks by the end of next week, Bloomberg reported Monday. Account takeovers at online brokers were already a policy issue in Japan: fraudulent trades on hijacked accounts exceeded ¥500 billion between March and May 2025.

Expect more brokers to follow FXTF's path and make two-step login the default rather than the option, with compliance deadlines landing in weekly maintenance windows over the coming weeks.