[Important] Current Response to Unauthorized Access to “Onamae.com Desktop Cloud” (Fifteenth Report)

October 29, 2026

Internet Infrastructure

[Important] Current Response to Unauthorized Access to “Onamae.com Desktop Cloud” (Fifteenth Report)

~ Promising information believed to lead to the identification of the perpetrators to be submitted to the police and relevant authorities today; 270 tips received through the “GMO Cybercrime Bounty” ~

October 29, 2026 (as of 12:40 JST)

① Obtained promising information believed to lead to the identification of the perpetrators. To be submitted to the police and relevant authorities today

② 270 tips received through the “GMO Cybercrime Bounty” site (as of 11:30 on October 29)
③ Our gratitude to everyone cooperating in providing information and preventing the spread of information

We once again sincerely apologize for the great inconvenience and concern that the unauthorized access to “Onamae.com Desktop Cloud” has caused our customers and all others concerned.

We also extend our heartfelt thanks to everyone who has cooperated by providing information and by helping to prevent the spread of information related to this incident. We are deeply grateful and encouraged that so many people are voluntarily lending their support to protect our customers and prevent the spread of damage.

We would like to report on the status of information provided and on our efforts to prevent the spread of damage, as follows.

■ ① Obtained promising information believed to lead to the identification of the perpetrators. To be submitted to the police and relevant authorities today

We have received a great deal of information through the “GMO Cybercrime Bounty” site (see ② for details). In addition, our Group’s white-hat hacker team has conducted its own investigation and obtained information believed to lead to the identification of the perpetrators. To contribute to an early resolution, we will submit this information to the police and relevant authorities today.

■ ② 270 tips received through the “GMO Cybercrime Bounty” site (as of 11:30 on October 29)

To solicit promising information that will lead to the identification and arrest of the perpetrators and to the clarification of the incident, with regard to the unauthorized access to “Onamae.com Desktop Cloud” and the criminal acts related to this matter, we have established the “GMO Cybercrime Bounty,” with a total reward cap of USD 1 million (reference converted amount: approximately JPY 150 million).

We opened the “GMO Cybercrime Bounty” site to solicit information at 12:00 JST on October 28, 2026, and we are accepting information through a dedicated contact point.
As of 11:30 on October 29, we have received 270 tips.

We sincerely thank everyone who has provided information. We take each piece of information, submitted by people who took their valuable time to do so, seriously, and we are proceeding with its verification and examination.

We continue to accept information that will lead to the identification and arrest of the perpetrators and the clarification of the incident through the dedicated contact points below.
・Dedicated information submission site: https://cybercrimebounty.gmo/
・Email address for submitting information: [email protected]

Please refrain from attempting to identify or contact the perpetrators on your own, and from posting unverified information. Please send information to the dedicated contact points above.

For details of the “GMO Cybercrime Bounty,” click here (Twelfth Report)
https://internet.gmo/en/news/article/258/

■ ③ Our gratitude to everyone cooperating in providing information and preventing the spread of information

1）In responding to this incident, we have received cooperation in providing information and in preventing the spread of information from many people, including X users.

We once again express our deep gratitude to those who have refrained from reposting, quoting, or sharing links to the information, and to those who have voluntarily lent their support in their personal capacity to prevent the spread of damage.
We take very seriously, and are deeply grateful for, the cooperation everyone has offered for the protection of our customers and the prevention of the spread of damage.

2）We are grateful for everyone’s support, and, taking the protection of our customers and the prevention of the spread of damage as our own responsibility, we will continue to do our utmost in gathering information and preventing its spread. In addition, we will respond resolutely with legal action, including criminal complaints, against the attacks and threats related to this incident.

We accept consultations 24 hours a day at the contact below from customers who have suffered damage and from customers who have concerns.

■ Contact for Inquiries
Phone: +81-3-5456-2560 (open 24 hours, including weekends and public holidays)

■ Timeline to Date

・October 21 (Wed) 4:00: Suspended the Service and published the first report on the unauthorized access / Received a threatening email (demanding approximately 8 billion yen)
・October 22 (Thu) 13:00: Consulted the police
・October 22 (Thu) 16:59: Published the Second Report
・October 24 (Sat) 11:50: Decided on the payment of condolence payments, compensation for losses, and the provision of alternative services. Requested that relevant government agencies apply Active Cyber Defense (Fourth Report). Request to customers for security measures (Fifth Report)
・October 25 (Sun): Asked customers to cooperate with the device investigation
・October 26 (Mon) 21:00: Reiterated our requests to customers (Sixth Report) / 23:10: Began analyzing the devices we took custody of (Seventh Report)
・October 27 (Tue) 9:58: Announced the interim progress of the device analysis and requests in preparation for the announcement scheduled for 12:00 (Eighth Report) / 11:59: Announced the status of the device analysis and our renewed requests (Ninth Report) / 13:55: Announced the publication of information by the perpetrators (Tenth Report) / 14:55: Announced our requests to refrain from spreading information and our response policy (Eleventh Report)
・October 27 (Tue) 19:10: Announced the details of the special condolence payment for customers whose information has been published (Twelfth Report)
・October 28 (Wed) 11:00: Notice regarding the takedown of the perpetrators’ site (Thirteenth Report)
・October 28 (Wed) 18:20: Notice regarding our response in gathering information and preventing its spread (Fourteenth Report)
・October 29 (Thu) 12:40: Notice regarding promising information on the identification of the perpetrators (Fifteenth Report)

■ Contact Points for Inquiries and Information Submission Regarding This Matter

1）Consultations and inquiries from customers
We accept consultations regarding the use of “Onamae.com Desktop Cloud” and damage related to it.

・Contact form: https://help.onamae.com/contact/
・Phone: +81-3-5456-2560 (open 24 hours, including weekends and public holidays)

2）Providing information about the unauthorized access
We accept information that will lead to the identification and arrest of the perpetrators and the clarification of the incident.

・Dedicated information submission site: https://cybercrimebounty.gmo/
・Email address for submitting information: [email protected]

3）Reporting unauthorized publication and spreading of information
If you find a new perpetrators’ site, or a site where personal information or similar data is being published without authorization, please notify us at the contact point below.

・Reporting form: https://www.onamae.com/abuse/
※In the form, please select “About website content” and “Inappropriate content,” and fill in the required fields.

In addition, please refrain from accessing suspicious sites, and from reposting, quoting, or spreading URLs or published content on social media or elsewhere.

■ Previous Announcements