Platforms · Software · Providers · Markets
OANDA's Japanese brokerage held back withdrawal requests on Thursday 22 October 2026, warning that attackers may have obtained some clients' MetaTrader credentials. The firm said client assets remain segregated as required by Japanese law. The pause is intended to prevent payments being sent without authorisation.
The credentials were held on Onamae.com Desktop Cloud, a rented server service from GMO Internet Group. GMO said it found unauthorised programmes in customer server environments on Tuesday and disclosed the incident on Wednesday. From 4 a.m. Wednesday, it began taking servers offline across every plan. It has not announced when they will return, and said as many as 26,739 servers could be affected.
Traders rent these machines to keep MT4 and MT5 terminals, along with automated strategies, operating continuously. OANDA Securities is already transferring clients away from MT4 and plans to close the platform on November 27, following a timetable set in March that cited cybersecurity requirements.
AvaTrade Japan, Gaitame Finest and Dukascopy Japan have also issued security notices, bringing the number of Japanese brokers warning clients since Wednesday to four. None named GMO. AvaTrade Japan and Gaitame Finest said their own systems had not exposed client credentials.
Withdrawal timing and account steps
- OANDA said requests submitted by 11 a.m. On Thursday would be handled from 11 a.m. On Friday, after security checks, with funds expected in bank accounts by 4 p.m. Requests submitted by 11 a.m. Friday remain on the standard schedule.
- For clients who ran MetaTrader through GMO's service, OANDA advised changing both account credentials and MT4 or MT5 passwords, enabling two-factor login in MetaTrader and reviewing trade history. The broker said it had not yet decided on its further response.
- GMO advised customers to replace credentials kept on its servers and on any other service where they reused them. It said it had found no exposure of personal information it holds or evidence of data misuse, and does not retain customers' card details. New registrations are suspended. Its terms provide for a refund or credit if monthly uptime drops below 99.99%; GMO said it would set out its approach to the outage once decided.
The withdrawal pause refers to access at external services but does not identify the host. The series of warnings was first reported by Finance Magnates. Separately, GMO's chairman and chief executive, Masatoshi Kumagai, said on October 9 that the group would inspect all services after a data leak at a research company within the group, Nikkei reported.
Japanese brokers tighten authentication
Japan's Financial Services Agency has monitored online brokerage account takeovers since early 2025. Between March and May that year, fraudulent trades using hijacked accounts exceeded ¥500 billion (about $3.2 billion) across nearly 6,000 incidents.
IG's Japanese unit made two-factor authentication compulsory by June 2026, citing a rise in attempted unauthorised access across the industry. OANDA has required authenticator codes for withdrawals since December 2025.
Platform changes add another security step. MetaQuotes included unified client accounts protected by passkeys in MetaTrader 5 beta build 6030 in July. MT5 represented 65% of retail CFD volume on MetaQuotes platforms in the first quarter of 2026, against 35% for MT4, FM Intelligence data show.
In Asia-Pacific, the same firm's comparison recorded 1.5 million organic visits for MT5 in the third quarter and 709,700 for MT4. FTMO, a Czech prop trading firm, agreed to acquire OANDA from CVC Asia Fund IV in 2025.
What this changes for operators
For firms running terminals or strategies on rented VPS infrastructure, this incident puts credential handling and access recovery in focus. Operators should establish whether MetaTrader credentials, account passwords or other reused IDs were present in affected server environments, and whether their own account and trade-history checks can identify activity during the exposure window. OANDA has set out those checks for its customers, but has not detailed its longer-term response.
GMO has given no restart date, so firms relying on the service need to ask what migration or continuity arrangements are available before servers return. They should also confirm how any service credit or refund will be assessed under the 99.99% monthly uptime term. For brokers, a further question is how to verify withdrawal instructions while a client platform or its hosting environment may have been accessed by someone else.
