Vietnam Newsroom & Threat Intelligence
Evidence first. Intelligence that matters.
NOTEDo not attribute a ransomware family from a file extension or a single ransom note.Vietnam time · UTC+7
Home/International/GMO refuses extortion, offers up to US$1m bounty for attackers: 28 Oct update
International

GMO refuses extortion, offers up to US$1m bounty for attackers: 28 Oct update

GMO rejects demands after its Desktop Cloud breach, sets a total US$1m bounty and reports the attackers' domain disabled on 28 October. Ransomware deployment is unconfirmed.

Ransomware.VNPublished 3 min read

Updated: · Vietnam time (UTC+7)

TEKNews editorial infographic: Japan's GMO Internet Group rejects cyber extortion, offers a total bounty up to US$1m for leads, with investigative visual motifs, Ransomware.VN bitmap QR and original TUNGTEK PNG signature.
Editorial illustration · Original TUNGTEK signature · Not incident evidence.
Under verification

Cross-checked GMO notices dated 21–28 October 2026, especially reports 9, 10, 12 and 13 and the official Cybercrime Bounty terms. Unauthorized access, data exfiltration, publication of purported customer information, refusal to pay and the US$1m total reward cap are confirmed. As of GMO's report 10 at 13:55 JST on 27 October, ransomware deployment had not been confirmed. No family or impact in Vietnam is established; Ransomware.VN has not examined original samples, logs or devices.

Original story publication date and slug from 27 October are preserved; content updated 28 October. JST is UTC+9, two hours ahead of Vietnam. GMO's incident timeline cites an approximately JPY 8bn demand on 21 October, whereas US$1m is the total reward cap, NOT a confirmed ransom sum. The initial 26,739 count refers to potentially affected servers, not confirmed encryption. Existing original-signature artwork is illustrative, not forensic evidence.

Evidence / published sources

On 27 October GMO Internet Group said it would never comply with demands from suspected attackers of Onamae.com Desktop Cloud. Payment cannot guarantee deletion or prevent misuse of stolen data; the company is coordinating with police. [S6]

GMO announced a Cybercrime Bounty capped at US$1m overall, approximately JPY 150m using the program's reference conversion. This is neither a ransom nor an automatic payment to every tipster. [S6][S8]

GMO's incident chronology separately records a threatening email on 21 October asking for around JPY 8bn. The demand must not be confused with the US$1m reward fund. [S7]

Evidence / published sources

The official portal is https://cybercrimebounty.gmo/. It opened at noon JST on 28 October (10:00 Vietnam time) and closes on an arrest, an international wanted notice, or at 23:59 JST on 27 October 2027, whichever happens first. It accepts Japanese, English and Chinese. [S8]

GMO seeks new, actionable and verifiable evidence of participants, roles, servers, IP addresses, domains, accounts, cryptocurrency transactions or financial flows connected to the incident. Submitting a tip alone does not guarantee payment; awards depend on a proven contribution to arrest or an international wanted notice. [S8]

Unauthorized hacking, purchasing leaked data, contacting suspects or retaliation are not authorized. GMO will not ask for passwords, OTPs, secret keys or advance award fees. [S8]

Evidence / published sources

GMO said it saw purported company and customer information posted by suspected actors at around 12:30 JST on 27 October. It was still verifying content, which could include inaccuracies, and warned against accessing or sharing the leak site. [S5]

For customer information that GMO confirms was exposed, its special support tiers are JPY 10,000 for basic name/contact details, JPY 15,000 for financial or authentication information, and JPY 25,000 for sensitive personal information. Eligible categories may add up, subject to JPY 3m per publication. [S6]

This is separate from an earlier JPY 5,000 payment and qualifying compensation for unauthorized trading losses. [S3][S6]

Evidence / published sources

In report 13 issued at 11:00 JST on 28 October, GMO said the attackers' site domain had been disabled at approximately 04:00 JST after coordination with relevant providers. It continues to monitor for replacement domains and mirrors. [S7]

A domain takedown does not establish that every stolen copy was recovered, attackers arrested or the incident resolved. Avoid propagating mirrors or private information. [S7]

Evidence / published sources

The actors reportedly threatened data publication and ransomware deployment at noon JST on 27 October. GMO's 11:59 update said that completed device examinations had not found malware, including ransomware, while analyses remained ongoing. This was not a guarantee that every device was safe. [S4]

At 13:55 JST on 27 October, GMO still had not confirmed ransomware execution. Data theft and publication do not, by themselves, establish encryption. No publicly reviewed sample, hash, ransom note or execution log permits Ransomware.VN to name a family. [S5]

The initially reported 26,739 were potentially affected servers, not confirmed encrypted devices. [S1]

Technical assessment

The GMO incident spans unauthorized infrastructure access, exfiltration, possible account abuse, threats of ransomware and public posting of information. GMO found malicious software in some Desktop Cloud environments and suspended services from 21 October before later confirming data was taken outside the environment. [S1][S3]

Similar operators should preserve evidence, establish exposure scope, restrict compromised accounts, review endpoints and verify backups before attempting restoration.

  • Reset passwords and revoke sessions from a clean device; enable MFA for relevant accounts.
  • Preserve logs and forensic images before wiping, rebuilding or testing recovery tools on sole originals.
  • Fully examine potentially exposed endpoints and verify offline backups.
  • Never browse leak sites or amplify private information; beware fake support or fake bounty messages. [S6][S8]
Technical assessment

GMO has announced non-payment, a US$1m total bounty and customer support while cooperating with investigators. Domain takedown is a mitigation step, not proof that the incident has ended. [S6][S7]

Ransomware.VN / TEKNews will continue to distinguish verified primary disclosures from unresolved malware deployment. No evidence reviewed here establishes a specific ransomware family, mass encryption or Vietnamese victims.

RansomwareCloudData BreachJapanGMO InternetTEKNewsCybercrime BountyData Extortion
GMO Internet / Onamae.com — Unauthorized access notice21/10/2026 04:00 JST · Confirms malicious-program discovery, full service suspension and the number of potentially affected servers.
GMO Internet — Unauthorized access update 222/10/2026 16:59 JST · Reports possible theft of trading credentials and customer reports of unauthorized account activity.
GMO Internet — Cyberattack update 424/10/2026 11:50 JST · The company confirms data exfiltration and describes threats, containment, compensation and platform replacement.
GMO Internet — Incident update 927/10/2026 11:59 JST · Completed endpoint examinations had not found malware, with other examinations ongoing.
GMO Internet — Incident update 1027/10/2026 13:55 JST · Confirms a posting of purported data and no confirmed ransomware deployment.
GMO Internet — Incident update 1227/10/2026 19:10 JST · No-payment policy, customer support tiers and US$1m total bounty.
GMO Internet — Incident update 1328/10/2026 11:00 JST · Attackers' domain disabled around 04:00 JST.
GMO Internet Group — Cybercrime Bounty28/10/2026 12:00 JST · Official bounty eligibility, dates, evidence and safety guidance.

Each source's scope and date are recorded separately when available. A citation does not independently verify every assessment.

· Published VI/EN coverage from five primary GMO notices, separating confirmed unauthorized access and data exfiltration from an unconfirmed ransomware threat, with six event-specific images using the current logo and original TUNGTEK signature.

· TEKNews 28 Oct update from GMO 9/10/12/13 and bounty rules; total US$1m cap, customer support and domain takedown; ransomware unconfirmed. Original URL, publication date and existing artwork retained.

· Published six optimized TEKNews WebP variants, using the scannable Ransomware.VN bitmap QR and original TUNGTEK signature raster; updated hero, social and thumbnail imagery without changing the article URL or verified substance.

Corrections policy
N
Ransomware.VN

AI-assisted editorial summary. Public sources and verification limits are stated for each article.