# Attackers Cut GMO Crypto Ransom Demand to $1 Million as Leak Domain Goes Offline By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/42646 Published: 2026-10-28T14:03:42.000Z Updated: 2026-10-28T14:03:42.000Z Section: Technology > The attack on GMO Group’s cloud desktop service may have affected 26,739 servers. GMO Coin said it found no unusual activity in customer accounts. Attackers targeting GMO Group cut their demand for payment in Bitcoin (BTC) and Ether (ETH) to $1 million, while the domain hosting leaked data was taken offline Wednesday, marking a new turn in the extortion campaign. The attackers initially sought $50 million. The operation targeted GMO Group’s cloud desktop service, which could have affected as many as 26,739 servers; that is a potential reach, not a confirmed intrusion count. In their ransom note, the attackers claimed GMO’s cryptocurrency exchange could quickly provide the funds. They threatened continued unusual trading in affected accounts and the release of customer data. After publishing some information, they warned they would post more each day. 熊谷正寿, a GMO Group representative, refused to compromise and paid nothing. GMO Coin said it found no unusual activity in customer accounts. TokenPost’s [earlier coverage of the GMO breach]() detailed the initial ransom demand and the customer data exposure claim. ## Links in this article - [earlier coverage of the GMO breach](https://www.tokenpost.com/news/technology/41935)