Platforms · Software · Providers · Markets
GMO Internet Group has put up to $1 million towards information that helps identify and arrest the hackers behind a breach of its trading server service. The site used to publish material the attackers described as customer data went offline early Wednesday.
Attackers published customer material
The data posts began on Tuesday, following GMO's refusal to pay a demand of about ¥8 billion (about $50 million). GMO said it worked with other companies to have the domain suspended at about 4:00 local time. It also plans to pursue copies of the material elsewhere.
FX brokers tighten account access
FXTF is extending two-step login beyond MT4 and MT5 to its client portal and FXTF GX platform. The change follows weekly maintenance on 31 October.
The Tokyo-based broker, which operates more than 280,000 accounts, says clients who have not enabled the additional check will lose access from Saturday. The setup window will no longer be dismissible.
Login codes are sent to each client's registered email address, leaving access dependent on that inbox being able to receive them. FXTF was among five brokers to confirm unauthorized trades by Monday and is due to become GW Securities on 1 November.
Dukascopy Japan said some clients using GMO's service had trades executed without their consent. It reset passwords on accounts with suspected unauthorised access and closed all active sessions, while reporting no indication that its own systems were accessed.
Compensation remains difficult to price
OANDA Japan has told MT5 users it is strengthening login protection. For clients on rented servers, it advised changing the default remote desktop port and limiting connections to specified IP addresses.
The broker plans to retire MT4 on 27 November. XTB took a comparable step in Poland last year. After a customer reported hackers had emptied the account by rapidly trading stocks with little liquidity, XTB made two-step login compulsory for all clients within hours.
A Tokyo Stock Exchange filing sets out six types of payments tied to the incident, including ¥5,000 for each service user, reimbursement for realised losses from unauthorized trades and a replacement PC for customers affected by ransomware. Confirmed publication of personal data would qualify customers for ¥10,000 to ¥25,000 per exposed information category, capped at ¥3 million for each disclosure. GMO says it cannot calculate the overall bill until the eligible customer count and scope of published data are known. Finance Magnates reported the filing and broker responses.
GMO Internet Group is paying for the reward and started accepting tips at noon. The company said it "will never comply with the attacker's demands" and is working with police. Its shares ended at ¥3,324, up 5.2% from Tuesday, after dropping 15.7% on Monday. GMO has not disclosed how many customers' data was published; it said last week that up to 26,739 servers may have been exposed. Bloomberg reported on Monday that Prime Minister Sanae Takaichi had asked her cabinet to prepare emergency cyberattack measures by the end of next week. Fraudulent trades on hijacked online-broker accounts exceeded ¥500 billion between March and May 2025.
What this changes for operators
For brokers, the immediate systems work sits at the authentication and access-control layer: check whether two-step login covers the portal as well as the trading platform, and verify that the email channel can deliver codes reliably. Firms using rented servers should establish which clients still rely on default remote desktop settings and whether access restrictions are in place.
Operators should also confirm how suspected unauthorised trades are identified, sessions revoked and losses reconciled, then check what evidence is needed to assess any customer compensation. GMO has not provided the number of affected customers or the extent of the published data. Those gaps leave the scale of remediation and the potential payment exposure unresolved.
