GMO Internet will pay customers whose information an apparent attacker has published up to ¥3mn per release, and its parent, GMO Internet Group, will fund a bounty of up to $1mn for information on those involved. Both companies set out the terms in notices dated October 28, restating the policy they released on October 27 in their twelfth update on the incident at the "Onamae.com Desktop Cloud" service. Earlier Tokyo Brief coverage
What customers receive
GMO Internet will pay a "GMO special condolence payment" to customers whose data it has confirmed in the published material. The payment is ¥10,000 to ¥25,000 for each category of information published. Amounts are added together when several categories appear, with a ceiling of ¥3mn per release. It comes on top of the flat ¥5,000 payment to all current users of the service announced in the fourth update on October 24. Eligible customers will be contacted individually, and the company says the terms may be revised if the status of the publication changes.
Customers harmed by the publication will receive support "according to the circumstances"; the notice gives no content or amount for it. GMO Internet is also covering realised losses on trading accounts from transactions it recognises as unauthorised. Customers who report ransomware damage can receive a replacement PC of equivalent performance, although the notice says ransomware had not been confirmed as of the tenth update on October 27.
No payment to the attacker, and a bounty
The group says it will never comply with the attacker's demands. Its stated reasons are that complying would not guarantee deletion of the acquired data or the prevention of its misuse, and that it has a social responsibility not to encourage crime. It has consulted the police and other authorities.
GMO Internet Group is the sponsor and payer of the "GMO Cybercrime Bounty", capped at $1mn (about ¥150mn on the notice's reference conversion). Tips on those involved are accepted from noon Japan time on October 28, and payouts will be decided after review under the programme's terms, so the amount actually paid is open. The group is also preparing legal action, after preserving evidence, against people it calls highly malicious spreaders of the published data, and asks the public not to access or share it. It cautions that unverified material may contain false content.
Cost and scope still open
GMO Internet Group says the total cost to its consolidated results cannot be calculated. It names three unknowns: how many customers are eligible, how far the published information extends, and which transactions qualify for compensation. GMO Internet bears every cost except the bounty.
The group's white-hat hackers are still analysing customers' devices, including for any planted malware. The group says it has so far confirmed no impact from this incident on services other than the desktop-cloud service, while checks across group companies continue.