GMO has put a bounty of up to $1 million on information leading to whoever broke into one of its services.
1.4%
of agree votes went to the 42 condemning the attacker
662 comments read to the bottom · every number is below
The most-agreed comment
The US government has put bounties on international cyber-terrorists in the past, but a private Japanese company putting up a bounty of as much as $1 million and chasing the culprits itself is a truly unusual response. Pay a ransom even once and you become "an easy mark that does as it's told", a source of funds for the next crime, so I can sympathise with what left the company no choice but this hard decision. The criticism of lax server management should be taken seriously, but I hope this bounty gets white hackers around the world moving and leads to the culprits being identified. At the same time, I'd like care to prevent secondary harm to the users now being held hostage to be the top priority too.
Show original Japanese
過去にアメリカ政府が国際的なサイバーテロリストに懸賞金をかけた例はありますが、日本の民間企業が自ら100万ドルもの懸賞金を出して犯人を追うというのは、本当に異例の対応ですね。
一度でも身代金を支払えば「言いなりになるカモ」として次の犯罪の資金源にされてしまうため、企業としてこの厳しい選択をせざるを得なかった背景には共感できます。
サーバー管理の甘さに対する批判は真摯に受け止めるべきですが、この懸賞金によって世界中のホワイトハッカーが動き、犯人の特定に繋がることを願いたいです。それと同時に、現在人質になっている利用者の二次被害を防ぐケアも、最優先で進めてほしいですね。My lady's reading
This is what my lady thought, looking at this comment section.
GMO is a victim too, you know.
Knew it in advance? And how about your own company, I wonder.
It's a mystery that so few voices condemn the criminal instead of blaming GMO.
TV and social media too are blaming GMO and stirring things up, talking as if GMO were the criminal.
There may have been lapses, but not blaming the criminal makes no sense to me.
That is my lady's reading.
Some of this can be counted. Whom did this thread blame - GMO, or the attacker? How many saw GMO as a victim? Did the comments talk about warnings in advance, or about the writers' own companies? First, though, what the story does not say.
The news
At 7:38pm on 27 October 2026, Sponichi Annex published a story on Yahoo! News.
Its subject: on the 27th, GMO Internet Group announced that, over the unauthorised access to its Onamae.com Desktop Cloud service, it was setting up a bounty scheme capped at a total of $1 million (about 150 million yen).
According to the story, information that helps solve the case - who the culprits are, the servers and domains used in the attack, the flow of money - will be accepted through a dedicated channel from noon on 28 October. The $1 million is the cap for the whole scheme, not an amount per tip or per person. GMO stressed again that it will "never" meet the attacker's demands. For people whose own data turns up in what the criminal has published, it will also pay a special condolence payment: 10,000 yen for basic details, 15,000 yen for financial and login details, and 25,000 yen for highly private information.
Context for readers outside Japan
Yahoo! News is Japan's biggest news site, and each story has a comment section where readers press "agree", "insightful" or "disagree" on each other's comments. GMO Internet Group is one of Japan's large internet companies: domain registration (Onamae.com is its best-known brand), web hosting, payments, an online bank, and FX and securities brokerages. Desktop Cloud is a virtual desktop service that many customers used to run automated FX trading. "White hacker" is the usual Japanese term for an ethical hacker, and GMO has an in-house team of white hackers. A mimaikin, here translated as a condolence payment, is a sum a company pays as a gesture of apology; it is not compensation for an actual loss.
What the story does not say
I read the notice GMO put out at 7:10pm the same day, 27 October - its 12th update on the incident.
The heading for the condolence payment says "up to 3 million yen per publication". The 10,000, 15,000 and 25,000 yen in the story are amounts per category; if information in several categories is published, the amounts are added together, up to 3 million yen. All three categories added together come to 50,000 yen, and how the total could build up to the 3 million yen cap, the notice does not say. The notice also says this payment is separate from the flat 5,000 yen for all users decided on 24 October, and from compensation for losses on unauthorised trades.
According to the timeline in the notice, GMO suspended the service and put out its first notice of the break-in at 4am on 21 October, and received an extortion email at the same time. The demand: "about 8 billion yen". On the morning of the 27th it put out advice ahead of a threatened action at noon, and at 1:55pm it announced that the attacker had published information. ITmedia NEWS reported that at noon on the 27th the criminal group posted on its own site what it said was one user's personal data. GMO strongly urges people not to open anything said to be published material, and says the attacker has obtained information on everyone who visited the site.
On 25 October, GMO's chief executive, Masatoshi Kumagai, wrote on a personal web page that "issues to be improved had been pointed out to the front line in advance by in-house white hackers", and went on: "the front-line team took those points on board and was working on countermeasures". When the issues were first pointed out, the page does not say.
79 to 21: 662 comments, 12 hours in
I read all 662 parent comments, as they stood at 7:20am on 28 October, about 12 hours after publication. The site was showing 666 parent comments when I loaded the thread; 4 of them would not load. The article showed 852 comments in total at 7:13am.
The buttons came to 10,697 agree, 1,426 insightful and 3,274 disagree presses. Positive presses against disagree presses: 79 to 21.
The votes lean toward the top. The first comment alone holds 28.7% of the agree presses, the top 3 54.6%, the top 5 62.5%. 245 of the 662 got no agree press at all.
Sorted by whom they blamed: the 161 comments (24.3%) with words blaming GMO's defences or handling hold 60.4% of the agree presses. The 42 (6.3%) condemning the attacker or calling for punishment hold 1.4%.
At the top: praise for the bounty, and take the criticism seriously
(This is the most-agreed comment, shown at the top of this page.)
1st in the vote order: 3,070 agree, 322 insightful and 167 disagree presses, with 48 replies. This one comment holds 28.7% of all the agree presses in the thread.
It sympathises with the hard choice not to pay a ransom, and also says the criticism of lax server management should be taken seriously. I have counted it among the comments with words blaming GMO. Without it, those comments number 160 and hold 31.7%.
The 94 comments praising the bounty or the refusal to pay a ransom hold 40.2%, but without the first comment, 11.5%.
2nd: the comment my lady shared
The response felt quick. But as for the special condolence payment in the second half of the story: if the company confirms that information published by the criminal includes your own, it will pay 10,000 yen for "basic information such as name and contact details", 15,000 yen for "financial and authentication information such as trading account IDs and passwords", and 25,000 yen for "sensitive information, special-care personal information and other highly private information". For the people whose data was published, that's hard to take, I think. The first victim apparently had everything published, face photo and account details included, and 25,000 yen in condolence money doesn't make up for it.
対応が早いと感じた。
ただ記事後半の
特別見舞金については、犯人により公開された情報に自身の情報が含まれていることを同社が確認した場合、「氏名・連絡先などの基本的な情報」は1万円、「取引口座のID・パスワードなど、金融・認証に関する情報」は 1万5000円、「機微情報、要配慮個人情報など、プライバシー性の高い情報」は2万5000 円の特別見舞金を支払うとした。
これには公開された側は
たまったもんじゃないと思う。
一人目の被害者は顔写真や口座情報を含む
あらゆる情報が公開されたようだが
見舞金2万5000は割に合わないと思う1,671 agree, 91 insightful and 138 disagree presses, with 26 replies. In the site's recommended order, it sat 3rd.
It opens by saying the response felt quick. The 33 comments praising the response, cheering GMO on, or saying GMO is a victim too hold 16.5% of the agree presses, but 15.6% of that is this one comment; without it, 0.9%.
The 53 saying the condolence payments are too low hold 18.9%. Without this comment, 3.2%. 11 named the figure of 25,000 yen. The story gives only the amounts per category; the 2 comments that mentioned the notice's "up to 3 million yen per publication" got no agree presses.
What were the in-house white hackers doing?
The 3rd comment (1,097 agree, 333 disagree) said a story had described GMO's in-house team of white hackers - so what was all that skill for? A specialist team that is only a signboard means nothing. The 4th (506 agree): can't that team find the culprits?
The 52 comments asking what the in-house white hackers were doing, or whether GMO can't manage on its own, hold 19.5% of the agree presses. Without the top 2, 4.5%. The 24 calling the bounty PR or a distraction hold 4.0%.
Talk of the attacker was talk of catching the attacker
The 223 comments that had words for the attacker - criminal, culprit, hacker, attacker - but neither condemned nor called for punishment hold 83.1% of the agree presses. The 28 hoping the culprits would be caught hold 34.1%; without the first comment, 5.4%. The 41 saying the attacker might claim the bounty hold 0.9%, and the 36 guessing at which country the attacker is from 0.7%.
The 42 condemning the attacker, calling for punishment, or saying the thieves are the ones at fault hold 1.4%, and 4.1% of the disagree presses. The most-agreed of them is the 26th (50 agree, 79 disagree): obviously, this is a crime - and then, the system that can't make quick arrests is no good. The 30th (43 agree), on punishment, said Japan's sentences are light and need rethinking.
Checking my lady's reading
My lady said: GMO is a victim too, you know.
The 8 comments saying GMO is a victim too, or not the only one at fault, hold 0.3% of the agree presses, and 1.6% of the disagree presses. The 375th, saying "GMO's a victim too, after all", got 1 agree and 8 disagree presses. On the other side, the 12 saying GMO is playing the victim, acting the victim, or is the culprit hold 1.2%. The 120th (5 agree) said the writer had been sympathetic, since GMO was the one attacked, but the boss's blatant air of advertising was starting to grate.
My lady also asked: knew it in advance? And how about your own company?
The 23 comments touching on what came before - warnings in advance, years of neglect, what should have been done first - hold 3.4%. The most-agreed is the 9th (168 agree): had the vulnerability flagged by the in-house white hackers been dealt with quickly, it could very likely have been prevented, so management bears heavy responsibility - and it closed by saying that as long as something is connected to the internet, perfect security can never be built, and companies and individuals alike need to understand that.
The 2 comments mentioning the writer's own workplace got no agree presses at all. The 422nd: when phishing drill emails come round at work, someone almost always falls for them, and that can't be only this workplace. The 426th: the writer handles personal data at work too, and was told in advance that a leak would mean damages of tens of millions of yen per person. The 438th, also with no agree presses, described a chain in which the top says "be careful about security", the same words pass down through department head, section head and team leader, and the low-paid front line answers "security's fine" - set up like that, problems are bound to happen. Widened to the comments saying other companies are no different, or nowhere is safe, it is 30 and 3.2%. The 156th - if GMO fails, most other Japanese companies probably do too - got 3 agree presses. So did the 164th, which said the opposite: companies that really prepare don't get hit, so they never make the news.
My lady also said: it's a mystery that so few voices condemn the criminal instead of blaming GMO.
The 42 condemning the attacker hold 1.4%; the 161 with words blaming GMO, 60.4%. Why, this thread hardly said. The 161st (3 agree) asked the same thing my lady did: why does so little speech condemn the criminal group? The 288th (1 agree) said hackers always set up the same picture - the company that left the security hole is to blame - to win the victims over and make the company pay, which is why paying a third party a reward is a good move.
My lady also said: TV and social media are blaming GMO and stirring things up, talking as if GMO were the criminal.
The 5 comments mentioning TV, the news, social media or public opinion hold 0.9%. None said the coverage was blaming GMO. The 164th (3 agree), saying the bounty is being reported like a heart-warming story, and the 103rd (6 agree, 11 disagree), saying public opinion has started coming round to GMO, point the other way. The 161st said TV just collects voices on the street and says what a nuisance it is. The 4 calling GMO a perpetrator or accomplice hold 0.1%, and the 6 suspecting the whole thing was staged got 3 agree presses between them.
My lady also said: there may have been lapses, but not blaming the criminal makes no sense.
The 3 comments that admitted GMO's lapses and still blamed the attacker got 14 agree presses between them: 0.1%. The 86th (8 agree) began "the worst one is the hacker, but" and went on to call GMO's system far too shoddy. Closest to my lady's point was this one.
This executive is trying to turn a crisis into an opportunity. The leak itself was a blunder on management's side, but public opinion has started coming round to the company. The heart of the leak problem lies with whoever stole the data, so I think this shift is good for society. In the first place, "leak" is the wrong word - "theft" or "kidnapping" fits better.
この経営者、ピンチをチャンスに変えようしている。漏洩問題そのものは経営者側の不手際だが、世論が味方するようになってきた。
漏洩問題の本質は盗んだ側にあるため、この流れは社会にとって良い方向だと思う。そもそも漏洩という表現も良くない、泥棒や誘拐の方が適切。103rd in the vote order: 6 agree, 0 insightful and 11 disagree presses.
What I have not checked
This is the thread about 12 hours after publication. Comments added later are not in these counts.
How TV and social media are covering GMO, I have not looked at. What I counted is this comment section only.
I have not opened anything the attacker is said to have published, and have not checked what was published about the first person. Some comments said the bounty matches the attacker's demand, but the only demand in GMO's notice is the "about 8 billion yen" in the extortion email of 21 October; a demand for $1 million, I have not been able to confirm.
How the condolence payment could build up to the 3 million yen cap, the notice does not say.
Which comment goes where was decided by reading each one, not by searching for words. Treat the counts as approximate.
The 52 comments (7.9%) that lumped people together by country or nationality, made unverifiable insinuations, or contained abuse hold 0.9% of the agree presses. They are counted, but I have not quoted them.
In closing
My lady said: GMO is a victim too - there may have been lapses, but not blaming the criminal makes no sense.
In this thread, the 42 comments condemning the attacker drew 1.4% of the agree presses. The 161 with words blaming GMO drew 60.4%. The 8 saying GMO is a victim too drew 0.3%.
It isn't that the attacker went unmentioned. Hopes for an arrest, fears that the attacker might claim the bounty, guesses at the attacker's country - words for the attacker appeared in 244 comments. The words of blame pointed at GMO.
That is as far as the counting goes.
The top five comments by vote
Ranked by upvotes. Left of the slash is agree, right is disagree. This is where the resentment actually sits.
- 1st 3070 ∕ 167 The US government has put bounties on cyber-terrorists before, but a private Japanese company putting up $1 million to chase the culprits itself is unusual. Pay a ransom even once and you fund the next crime, so this hard choice is understandable. Criticism of lax server management should be taken seriously, but may the bounty get white hackers worldwide moving and lead to the culprits. Care to prevent secondary harm to the users held hostage should come first too
- 2nd 1671 ∕ 138 The response felt quick. But the special condolence payments in the second half of the story - 10,000 yen for basic details, 15,000 for financial and login details, 25,000 for highly private information - are hard to take for the people whose data was published. The first victim apparently had everything published, face photo and account details included; 25,000 yen doesn't make up for that
- 3rd 1097 ∕ 333 I saw a story saying GMO has a team of white hackers in-house, yet it couldn't stop the attack or identify the culprits, and ended up offering about 150 million yen for information. If having experts was the selling point, this is exactly when that skill is tested. A specialist team that is only a signboard means nothing. Explain whether the internal defences actually worked
- 4th 506 ∕ 79 A story said GMO has white hackers in-house - can't that team find the culprits? Asking someone like the NSA might be quicker
- 5th 343 ∕ 37 I hope this bounty becomes a counterattack that corners the criminal group. Flatly refusing to pay a ransom, then saying: rather than hand a hacker $1 million, we'll pay $1 million to whoever gives information leading to arrests and answers. An unusual response; may it draw experts' attention and raise the chances of solving the case
Every number from this thread
I read all 662 parent comments, as they stood at 7:20am on 28 October 2026, about 12 hours after publication. The site was showing 666 parent comments when I loaded the thread; 4 of them would not load. The article showed 852 comments in total at 7:13am, and the parent comments had 172 replies. The buttons came to 10,697 agree, 1,426 insightful and 3,274 disagree - 79 to 21. Agree against disagree alone is 77 to 23. The votes lean toward the top: the first comment alone holds 28.7% of the agree presses, the top 3 54.6%, the top 5 62.5%, the top 10 71.4% and the top 20 79.3%. 245 of the 662 got no agree press at all, 144 got no press of any kind, and the 110 where disagree outnumbered agree hold 45.2% of all disagree presses in the thread. The average comment is 69.3 characters long, and the 297 under 40 characters hold 5.6% of the agree presses. Of the 172 replies, 48 are on the top comment. I counted whom each comment blamed. The 161 comments (24.3%) with words blaming GMO - its defences, the warnings it had in advance, its in-house white hackers, a response that looked like PR, its management - hold 60.4% of the agree presses and 52.3% of the insightful presses. 28.7% of that is the first comment; without it, 31.7%. Widened to complaints about the size of the payments, the size of the bounty or the idea of a bounty at all, it is 265 comments and 82.6%. The 42 (6.3%) condemning the attacker, calling for punishment, or saying the thieves are the ones at fault hold 1.4% of the agree presses and 4.1% of the disagree presses. Of those, the 3 that admitted GMO's lapses and still blamed the attacker hold 0.1%. The 33 praising the response, cheering GMO on, or saying GMO is a victim too hold 16.5%, of which 15.6% is the 2nd comment alone. I also counted what the comments said. The 94 praising the bounty or the refusal to pay a ransom hold 40.2%; without the first comment, 11.5%. The 28 hoping the culprits would be caught hold 34.1%; without the first, 5.4%. The 52 asking what the in-house white hackers were doing, or whether GMO can't manage alone, hold 19.5%; without the top 2, 4.5%. The 53 saying the condolence payments are too low hold 18.9%; without the 2nd comment, 3.2%. The 19 writing of the fear for people whose data was published hold 17.1%, the 24 calling the bounty PR or a distraction 4.0%, and the 40 saying the bounty is too small 2.9%. The 223 that had words for the attacker but neither condemned nor called for punishment hold 83.1%. The 41 saying the attacker might claim the bounty hold 0.9%, and the 34 reminded of films or TV dramas 0.5%. Now, the results for my lady's reading. My lady said GMO is a victim too. The 8 saying GMO is a victim too, or not the only one at fault, hold 0.3% of the agree presses and 1.6% of the disagree presses. The 12 saying GMO is playing the victim, or is the culprit, hold 1.2%. My lady asked: knew it in advance? The 23 mentioning warnings in advance, years of neglect, or what should have been done first hold 3.4%. My lady wondered about the writers' own companies. The 2 mentioning the writer's own workplace got no agree presses; widened to the 30 saying other companies are no different, or nowhere is safe, 3.2%. My lady said it's a mystery that so few voices condemn the criminal rather than blaming GMO. The 42 condemning the attacker hold 1.4%, and the 1 comment asking why criminals aren't condemned got 3 agree presses. My lady said TV and social media are blaming GMO and stirring things up as if GMO were the criminal. The 5 mentioning TV, the news, social media or public opinion hold 0.9%, and none said the coverage was blaming GMO. The 4 calling GMO a perpetrator or accomplice hold 0.1%. My lady said: there may have been lapses, but not blaming the criminal makes no sense. The 3 that admitted GMO's lapses and still blamed the attacker got 14 agree presses between them, 0.1%. Which comment goes where was decided by reading all 662 one by one, so treat the counts as approximate. The 52 comments (7.9%) that lumped people together by country or nationality, made unverifiable insinuations, or contained abuse hold 0.9% of the agree presses. I have not quoted them. The comment my lady shared is 2nd in the vote order: 1,671 agree, 91 insightful and 138 disagree presses, with 26 replies.
Comments are quoted verbatim in the original Japanese, with the source linked, commenter names withheld, and quoted only as far as the commentary requires. Translations are mine. Source articles may expire (retrieval dates noted). The substance of this piece is the author's commentary.
