Platforms · Software · Providers · Markets
GMO Internet Group is offering up to $1 million for information that helps identify and arrest the hackers who breached its trading server service. The site used to publish data the attackers said belonged to customers went offline early on Wednesday, 28 October 2026.
Data publication triggers response
The attackers began posting the purported customer records on Tuesday, after GMO rejected a demand of about ¥8 billion (about $50 million). GMO said it worked with other companies to get the domain suspended at about 4:00 local time, and intends to remove copies elsewhere. The group is funding the reward itself and began accepting tips at noon. It is also working with the police.
Login rules extend beyond rented servers
FXTF is extending two-step login beyond MT4 and MT5 to its client portal and FXTF GX. The requirement takes effect after weekly maintenance on 31 October, and clients will no longer be able to dismiss the setup window. Codes will go to each client's registered email address, leaving customers unable to enter if their inbox cannot receive them. FXTF, which operates more than 280,000 accounts from Tokyo, becomes GW Securities on 1 November.
Dukascopy Japan said clients using GMO's service had trades placed without their permission. It reset passwords on accounts with suspected unauthorised access and terminated all active sessions, while reporting no indication that its own systems were accessed. OANDA Japan is strengthening MT5 login security. It has asked clients using rented servers to replace the standard remote desktop port and restrict connections to approved IP addresses.
It plans to switch off MT4 on 27 November. XTB introduced compulsory two-step login for all clients in Poland last year, hours after a customer said hackers had emptied his account through rapid trading in thinly traded stocks.
GMO has not priced compensation
In a Tokyo Stock Exchange filing, GMO set out six payment categories connected to the breach. The disclosed examples include ¥5,000 per service user, reimbursement of realized losses from unauthorized trades and a replacement PC for customers affected by ransomware. People whose data GMO verifies as published will receive ¥10,000 to ¥25,000 for each exposed information category, capped at ¥3 million per disclosure. The company said the full bill depends on the number of eligible customers and the contents of the published data. The response, including the filing and login changes, was first reported by Finance Magnates.
Where this lands in the stack
For broker operations teams, the immediate work spans authentication across client portals and trading platforms, plus the delivery path for one-time codes. FXTF's change makes email access part of the login dependency. Operators should check how customers recover access if their registered inbox cannot receive a code, and confirm the rule is enforced consistently across the portal and FXTF GX.
For rented-server users, OANDA Japan's instructions put remote desktop exposure and IP restrictions on the checklist. GMO has said up to 26,739 servers may have been exposed, but has not disclosed how many customers' data was published. Teams should establish whether their infrastructure or clients' accounts were affected, and how unauthorized trades, session termination and any compensation claims will be reconciled. The wider policy backdrop includes Prime Minister Sanae Takaichi's request for emergency cyberattack measures by the end of next week; fraudulent trades on hijacked online brokerage accounts exceeded ¥500 billion between March and May 2025.
