Platforms · Software · Providers · Markets
Server scope and security reporting
GMO Internet Group said on 2 November 2026 that a security weakness in its Onamae.com Desktop Cloud service had been identified in 2024, before hackers breached it. The group has cut the pay of four executives, including founder Masatoshi Kumagai, who will forgo 30% of monthly compensation for three months.
The service rented Windows servers for customers running MetaTrader continuously. Up to 26,739 servers may have been exposed, and brokers confirmed that stolen login details were used to trade on client accounts. The service has not resumed.
At a Tokyo news conference, Kumagai said subsidiary GMO Cyber Security by Ierae found a vulnerability in April 2024, as Nikkei reported. Staff performed urgent maintenance on four occasions during April and May, but the underlying flaw remained.
Kumagai said the finding did not reach management through the group's internal reporting process. GMO is considering changes to how security information is escalated.
Management response and compensation
Tadashi Ito, deputy to the group chief executive and president of GMO Internet, will take a 25% pay reduction. Ito's listed subsidiary, GMO Internet, operates the service. Senior officers Hirofumi Yamashita and Kimihiro Kodama will each take a 20% reduction. The cuts apply from December pay for three months. Details of the warning and the executive response were reported by Finance Magnates.
GMO said the reductions reflect its assessment at present. It will review management accountability after establishing how the breach occurred. The group has offered each service user ¥5,000 (about $31) and pledged to reimburse realised losses from unauthorised trades. It plans to set out the claims process by Friday. A stock exchange filing last Wednesday said the overall cost remains unknown. The attackers had demanded payment by October 27, threatening to release customer data; after that date passed, they began publishing material they claimed was the data.
Broker operations face separate delays
OANDA Japan said a fault at partner bank docomo SMTB Net Bank is preventing it from processing withdrawal instructions. The issue affects clients who requested payouts from 11:00 on Friday to 11:00 on Monday, and the bank has not supplied a repair time. Payments scheduled for Monday will be sent again on Wednesday without a fresh client request. This is OANDA's second withdrawal delay in less than two weeks: it paused payouts for a day on October 22 after the GMO breach. The broker also said account applications submitted since Friday will take three to four business days to process because of internal workload.
FXTF said a configuration error caused its MT4 platform to run a client margin check at 13:30, rather than during its normal 15:30 to 15:45 window. The check tests whether an account has more than 100% of required margin.
FXTF, which operates more than 280,000 accounts, did not say how many were affected. It apologised and said it would examine both the settings and the processes used to manage them.
The integration question
Operators should establish whether any trading activity or client accounts relied on Onamae.com Desktop Cloud, and how they would identify and reconcile orders placed using stolen credentials. GMO has not provided a count of affected client accounts. What records would be needed to match potentially unauthorised trades against client balances, loss claims and any broker-side adjustments?
The reporting failure also raises a control question for firms with separate security and service teams: how does a vulnerability finding reach the people accountable for a live trading service, and how is closure of the underlying issue verified after maintenance? The separate OANDA Japan and FXTF incidents are reminders to check withdrawal dependencies, margin-check schedules and ownership of configuration changes without assuming they share a cause.
