Hackers place forex orders using credentials stolen from hosting provider GMO

On October 19, customers contacted GMO Internet. The Japanese hosting provider opened an investigation. The next day, it found malware on some servers of its Onamae.com Desktop Cloud service. The service rents remote Windows desktops, popular with individuals who run trading bots on the foreign exchange market. On October 21 at 4 a.m., GMO began shutting down the servers of all its offerings.

It was too late for some customers. As early as October 21, some noticed orders they had never placed on their brokerage accounts. According to GMO, up to 26,739 servers could be affected, but that figure does not count confirmed intrusions.

How did the hackers reach the accounts?

Trading bots need the broker's credentials to place their orders. These credentials were therefore stored on the servers, notably in the MetaTrader software. According to Finance Magnates, the hackers used them to place orders directly with the brokers. On October 24, in its fourth report, GMO acknowledged that customer information had been taken out of its systems.

The trade outlet read eleven broker notices. Five of them confirm fraudulent orders: OANDA Securities, FXTF, AvaTrade Japan, Gaitame Finest and Dukascopy Japan. None gives the number of accounts affected. None reports an intrusion into its own systems. Japan's financial regulator asked brokers to warn their customers and monitor transactions.

A ransom refused

According to GMO, the attacker is demanding money. The attacker threatens to keep placing orders on accounts held with more than 70 stock and forex brokers, in Japan and elsewhere. The attacker also threatens to publish data and to launch ransomware on customers' computers. On October 27, GMO noted that the attacker had posted online information presented as belonging to the hosting provider and its customers. GMO refuses to pay: in its view, nothing guarantees that the data would then be deleted. The hosting provider has passed its findings to the police. The amount demanded was specified on October 26: $50 million, or about 8 billion yen.

On October 25, the group's CEO, Masatoshi Kumagai, hardened his tone on his blog. According to OfficeChai, he believes the Internet "is already starting to break" and describes a saturation attack carried out with AI. GMO asked the government to apply Japan's active cyber defense law, in force since October 1, 2026. It allows the servers of an attacker to be neutralized. According to INTERNET Watch, it has never been used so far.

The lesson for anyone who entrusts credentials to a server

GMO promises 5,000 yen to each current customer. It will refund losses incurred on orders it recognizes as fraudulent, but not market losses or missed gains. It also offers six months of hosting on a new platform and will not restart the old one. On the broker side, OANDA will require passkeys and FXTF will require one-time codes.

The case concerns everyone who leaves a bot, a script or an agent running on a remote server with their banking or trading credentials:

• enable two-factor authentication with your broker, and not only with the hosting provider;
• prefer limited-rights credentials when the broker allows it (read-only, order caps);
• change all passwords saved on a server as soon as its hosting provider reports an incident;
• beware of calls and messages that mention the case: GMO says it never asks for a password or PIN code for compensation, except possibly a read-only MT4/MT5 password to check order history.

The hackers' entry point is still unknown. GMO has not yet disclosed it.