TOKYO, October 25, 2026 — A massive cyberattack on Japan’s GMO Internet Group has compromised more than 26,000 cloud servers, weaponizing retail hosting infrastructure to execute unauthorized foreign exchange trades across 70 brokerages worldwide.
Infrastructure Breach and Global FX Impact
The security intrusion targeted the Onamae.com Desktop Cloud VPS service operated by GMO Internet Group, according to company disclosures. Discovered on October 21, 2026, the breach affected approximately 26,739 customer servers running on the Windows remote-desktop virtual private server platform. Retail foreign exchange traders frequently rent these servers to run automated MetaTrader 4 and MetaTrader 5 trading bots around the clock. Rather than simply executing a standard data theft, attackers planted malicious programs within customer server environments to place unauthorized trades on accounts connected to more than 70 brokerages and securities firms globally, according to GMO Internet Group representative and CEO Masatoshi Kumagai.
The fallout quickly rippled across the financial sector as brokerage platforms responded to potential credential exposure. OANDA Japan halted customer withdrawals on October 22 as a precautionary measure, warning that hackers may have accessed MetaTrader login details stored on the affected cloud service, though the firm confirmed client assets remain segregated under Japanese law. AvaTrade Japan and Gaitame Finest also reported unauthorized trades on client accounts linked to external VPS services, while Dukascopy Japan urged all VPS users to change their trading passwords following the incident. Japanese regulators have tracked similar account takeovers since early 2025, when the Financial Services Agency recorded fraudulent trades exceeding ¥500 billion, equivalent to about $3.2 billion, across nearly 6,000 incidents between March and May of that year.
Corporate Response and System Overhaul
In response to the crisis, GMO Internet Group began shutting down servers across all plans at 4 a.m. on October 22 without setting a restart date. The company has pledged to provide every affected customer with a flat 5,000 yen condolence payment alongside full compensation for trading losses tied to the unauthorized access, even in cases where an exchange declines to refund the loss directly. Additionally, GMO offered users six months of free replacement hosting and stated it will overhaul its underlying system architecture in collaboration with outside security experts. CEO Masatoshi Kumagai admitted publicly that the breach was not entirely unforeseeable, noting that in-house white-hat hackers had previously flagged security gaps in the service, but the pace and depth of the internal response proved insufficient against competing priorities.
Government Appeal and AI Attack Tooling
Beyond financial compensation, GMO Internet Group escalated the matter by formally asking the Japanese government on October 24 to invoke the country’s newly enacted active cyber defense law on the company’s behalf. Kumagai argued that private enterprises cannot block sophisticated foreign attackers alone and require government authority to intercept threats before they reach domestic infrastructure. The active cyber defense framework allows security agencies to identify and disrupt threats outside national borders by scanning for malicious traffic and blocking suspicious addresses, though the policy has previously drawn debate over privacy concerns. Kumagai warned that open-weight AI models are now being freely combined into automated attack tooling, lowering the technical barrier required to execute large-scale network compromises and turning standard retail hosting into a weapon for financial fraud.
Threats of Data Leaks and Ransomware
According to Kumagai’s blog post, the attackers did not limit their activities to unauthorized trading. They also threatened to leak personal data found on compromised customers’ PCs, deploy ransomware against affected users, and publicly expose internal information about GMO’s systems and operations if their demands were not met. These additional threats underscore the severity of the breach, extending beyond financial fraud to potential privacy violations and operational disruptions for both customers and GMO itself.
The inclusion of ransomware and data leak threats highlights the evolving tactics of cybercriminals, who increasingly combine financial exploitation with data extortion. Kumagai emphasized that such multi-faceted attacks are becoming more common as open-weight AI models lower the technical barrier for executing complex, large-scale breaches. This incident serves as a stark reminder of the broader risks posed by interconnected financial and personal data systems, reinforcing GMO’s argument that this is a matter of national concern rather than an isolated corporate issue.
Sources
- The Internet Is Breaking Down, Says Japan's GMO Internet Group CEO After Hackers Hijack Its Cloud Servers To Run Unauthorized FX Trades
- OANDA Japan Holds Withdrawals After Hack at Server Host Used by FX Traders
- GMO Internet Seeks Active Cyber Defense From Japanese Government
Photo: Tyler / Unsplash (Unsplash License)
