Name.com VPS incident, are the hackers truly professionals? Negotiation failure and the mystery of a million-dollar bounty

?This article was posted on October 28, 2026＝＞Latest related articles?

When you think of hackers, you probably imagine a professional group with high-level skills breaking into companies and taking huge ransoms, right?

However, when we investigate the name.com VPS incident this time, there are points that just don’t sit right.

A monetary demand of about 8 billion yen and another figure of 1 million dollars. Even if personal information is disclosed, GMO’s compensation has a cap. And GMO, which has been pointed out for security issues, prepared a 1-million-dollar bounty to collect information about the perpetrators.

Who benefits and who pays the price, really?

This time, not only confirming the facts of the incident but also considering the attackers’ actions from a business perspective.

? About 8 billion yen to 1 million dollars? Is this price negotiation unnatural

The demanded amount in the reported extortion email is about 8 billion yen. On the attackers’ site, a figure of 1 million dollars was also cited. If 1 dollar = 150 yen, that is about 150 million yen. Compared to about 8 billion yen, that’s about 1/50.

Of course, it is not known whether both parties are asking under the same conditions or whether the amount was changed. However, such a large discrepancy is concerning.

There is a method of starting with a high demand and lowering it through negotiation. However, what these numbers mean is unknown. Did negotiations stall, leading to a change in the demanded amount? Or did they not consider a realistic amount from the start?

If the attackers are a professional group with financial motives, there should be calculations behind the demanded amount and the negotiation approach. However, from publicly available information, that calculation is hard to see. This is the first question.

? Even if personal information is disclosed, is the impact on GMO limited

The attackers published customer information on October 27. However, releasing information does not guarantee GMO will meet the demands.

GMO announced a special condolence fund of up to 3 million yen per disclosure for users whose information was made public. Of course, this does not mean the total damages from data breaches. There are also effects that cannot be measured by money alone—such as corporate trust and investigative responses.

Still, if the attackers believed that “releasing information would cause GMO to incur a large additional burden and force them to pay,” that plan may have failed, wouldn’t you say?

For users, data breaches are serious. However, increasing the number of victims and attackers gaining profit are separate issues. The usefulness of information disclosure as negotiating leverage remains questionable.

? It’s GMO’s security problem, so what is with the 1-million-dollar bounty

GMO established a bounty system with a total cap of 1 million dollars to gather information that could identify the culprit or shed light on the incident.

However, what is being questioned in this incident is not only the attackers’ responsibility. GMO itself admits there were security issues in its systems.

Capturing the culprit is important, but it does not automatically resolve the cause of the intrusion. While information is being gathered from outside through the bounty, to what extent are the issues on the service side being resolved?

Setting a bounty can be a rational means to gather information that internal investigations alone cannot obtain. Still, for users, solving the root cause and preventing recurrence are just as important as chasing the culprit.

? Hackers are also in business. Technicians? Poor negotiation?

Summing up these doubts, a hypothesis arises: the attackers’ technical ability and negotiating skills may be separate things.

It is possible that they used existing attack tools and generative AI to advance while researching. Of course, there is no evidence that AI was used this time, and there is not enough information to judge the attackers’ technical prowess.

However, if you think of criminal activity with a financial motive as a business, merely breaking in is not enough. Negotiations to reap profits are necessary.

Analyzing personal information continues to require effort. If disclosure continues without obtaining money, costs will rise and it may leave investigators clues.

Are they a group of highly skilled professionals? Or a group that succeeded in breaking in but did not adequately calculate how to proceed with intimidation?

Perhaps they are university or high school students who only used AI to hack, and this cannot be ruled out.

This incident also leaves questions about whether the attackers’ behavior was truly rational.

? In the end, are the hackers professionals? Our current assessment

Summarizing what we have so far, there are things that can be said with certainty and things that remain unknown about this incident.

What is confirmed: unauthorized programs installed on customer servers, external exfiltration of customer information, monetary demands, and information disclosure by the attackers.Meanwhile, the entry path, the attackers’ technical level, the exact number and attributes of people involved, and motives beyond money are not well supported by evidence.

Even if the damage is large, it cannot be concluded that the attackers are a “highly skilled professional group”.

For investors and traders, this incident is not someone else’s problem. If trading account authentication information is misused, assets can be lost regardless of market fluctuations.

However, do not misunderstand: this incident is not because GMO’s security failed or because passwords on home computers were leaked in the same way.

We should take reasonable precautions, but be careful of information that excessively alarms about danger.