Platforms · Software · Providers · Markets
On 22 October 2026, OANDA Securities delayed withdrawals requested by 11 a.m. Thursday, warning that attackers may have accessed some clients' MetaTrader credentials stored on Onamae.com Desktop Cloud. The broker said client assets remain segregated as Japanese law requires.
The hosted service is operated by GMO Internet Group. GMO said it found unauthorised programmes in customer server environments after detecting the activity on Tuesday. From 4 a.m. Wednesday it began shutting down servers on every plan, with no restart date announced. Up to 26,739 servers may be affected.
FX traders use rented servers to keep MT4 or MT5 terminals and automated strategies running continuously. OANDA is also preparing to retire MT4 on November 27, a timetable it set in March citing cybersecurity requirements.
How the withdrawal schedule works
- OANDA said it will process requests made by 11 a.m. Thursday from 11 a.m. Friday, after completing security checks. Payments should arrive in clients' bank accounts by 4 p.m.
- Requests received by 11 a.m. Friday will use the broker's usual processing timetable.
- Clients who used the GMO service to run MetaTrader were told to replace their account and MT4 or MT5 passwords, enable two-factor login in MetaTrader and review their trade histories. OANDA said it had not yet settled on its next steps.
- The withdrawal notice referred to access risks at external services but did not identify GMO by name.
Three brokers issue security warnings
- AvaTrade Japan said third parties had accessed some accounts belonging to clients using external services, including VPS providers, and placed unauthorised trades.
- Gaitame Finest reported on Wednesday that some client accounts had been accessed and used for trading with credentials that may have been exposed through other services. The broker restricted the affected accounts.
- Dukascopy Japan asked all VPS users to change their trading passwords. Neither AvaTrade Japan nor Gaitame Finest attributed its incident to GMO; both said their own systems had not leaked client credentials. Together with OANDA, the alerts make four Japanese brokers to raise account-security concerns since Wednesday.
Japan's authentication controls are tightening
The Financial Services Agency (FSA) has monitored online brokerage account takeovers since early 2025. It said fraudulent transactions on compromised accounts topped ¥500 billion (about $3.2 billion) across nearly 6,000 incidents between March and May that year. Two-factor authentication became compulsory at IG's Japanese unit by June 2026, after the company cited increasing attempts at unauthorised access across the industry.
OANDA introduced authenticator codes as a condition for withdrawals in December 2025. In July, MetaQuotes added passkey-protected unified client accounts to MetaTrader 5 beta build 6030.
OANDA's warning applies to clients using either MT4 or MT5 on the GMO service. MT5 accounted for 65% of retail CFD volume on MetaQuotes platforms in the first quarter of 2026, compared with 35% for MT4, according to FM Intelligence.
Its platform comparison recorded 1.5 million organic website visits for MT5 in Asia-Pacific in the third quarter, against 709,700 for MT4. The incident and withdrawal timetable were reported by Finance Magnates.
GMO said it had found no evidence of personal information held by the company leaking or data being misused, and said it does not store customers' card details. It advised users to change credentials held on the servers and anywhere else they had reused them. GMO has stopped accepting new sign-ups. Its terms provide for a refund or credit if monthly uptime falls below 99.99%; the company said it would set out its approach to the outage after making a decision. FTMO agreed in 2025 to buy OANDA from CVC Asia Fund IV.
What an operations team should check
For firms running trading terminals on third-party VPS or cloud infrastructure, the immediate operational checks are credential reuse, two-factor settings and account activity. OANDA has directed affected users to check trade histories, while GMO has advised password changes. Operators need to establish which credentials and services depend on the affected environments, and whether account access or automated strategies require reconfiguration.
The withdrawal pause also puts payout operations and client communications under scrutiny while security checks run. Teams should verify which requests fall into each processing window and how they will reconcile any delayed payments. GMO has not set a service restart date, so operators will need to ask what recovery arrangements apply, how the outage will be reflected in service credits, and whether any further account controls are required.
Operators should establish which client accounts used GMO-hosted servers, whether those environments held broker logins and which automated strategies relied on them. They should also ask whether the planned MT4 retirement changes the migration path for affected clients, given OANDA's November 27 switch-off date.
