TechReview
Cybersecurity

GMO CEO Admits Internal Warnings Were Too Slow Before Cloud Breach That Hit FX Traders

Published By Shivam Sharma6 min read
GMO Internet CEO Masatoshi Kumagai admits security warnings were answered too slowly before the Onamae Desktop Cloud breach

GMO Internet Group CEO Masatoshi Kumagai admitted in a blog post on 25 October that in-house security specialists had flagged flaws in the company’s Onamae.com Desktop Cloud service before attackers broke in, and that the response had been too slow and too shallow. The affected service is operated by listed subsidiary GMO Internet Inc., while the group company is GMO Internet Group Inc. Attackers planted unauthorised programs in some customer server environments on the rented service, which retail FX traders use to run MetaTrader bots around the clock, and customers reported unauthorised FX trades following the incident. GMO is paying every current customer ¥5,000 as a goodwill gesture and compensating verified losses separately, and its shares slumped 11% in Tokyo morning trading on Monday, against flat trading in the benchmark index.

What happened, and when

The investigation began after a customer inquiry on 19 October 2026. On 20 October, GMO confirmed that a third party had installed unauthorised programs in some customer server environments on Onamae.com Desktop Cloud, a rented server service used to run MT4, MT5 and Expert Advisors around the clock. From 04:00 JST on 21 October, GMO began shutting every Desktop Cloud plan in sequence, and it has set no restart date.

On 22 October, customers reported unauthorised trading-account operations. OANDA Japan separately held withdrawal requests submitted that day while running security checks, calling it a preventive measure against unauthorised withdrawals. On Saturday 24 October, GMO asked the Japanese government to take “active cyber defense” measures. GMO said the request, if acted on, would mark the first use of the government’s powers to neutralise threats posed by servers used in cyberattacks since a law enabling such measures took effect on 1 October 2026. The government is expected to consider the request carefully, and an official said it does not disclose whether measures have been activated. On the night of 25 October, Kumagai published the blog post admitting the earlier warnings, and on Monday morning Reuters reported the compensation and the shares fell 11% in Tokyo, against flat trading in the benchmark index.

The timeline suggests the admission itself moved the market. Shares fell on Monday morning, after the Sunday blog post, not in the days after the 20 October confirmation. Our calculation, labelled as TechReview’s own analysis: Reuters put GMO’s market value at $2.6 billion as of Friday’s close, so an 11% slump implies roughly $286 million in paper market value wiped out in Monday morning trading. That is a market-value movement, not a loss figure for the breach itself, and GMO has disclosed no breach-loss total.

What was taken, and what was not

GMO confirmed that customer information was taken outside the company. Trading-account login information stored on affected servers may have been obtained and misused; the individual cases and full extent remain under investigation. GMO says it does not hold customer payment information, including credit-card details, on the service’s servers. The notices concern this particular cloud service only. Nothing in them covers GMO’s entire internet business, its cryptocurrency exchange, or the underlying systems of customers’ brokers.

GMO said 26,739 servers may be affected, and explicitly said this was not the number of confirmed intrusions or cases of information theft. The number of actually compromised servers, the number of trading accounts with unauthorised activity, and the total financial value of losses are all still undisclosed and under investigation. GMO has not published a confirmed total of affected customers or victims.

The admission that the warnings came too late

In the blog post, Kumagai acknowledged that internal security specialists had identified weaknesses before the intrusion, but the response lacked sufficient speed and depth. He wrote that in-house white-hat hackers had previously raised issues with the service, that teams were working on remedies, but that concerns about availability and competing priorities slowed an adequate response, leaving an opening for attackers. He also warned that misuse of AI was accelerating cybercrime and called for stronger government cooperation. That broader warning does not establish that AI was used in this specific breach; the intrusion route and full extent of the compromise remain under investigation.

A person believed to be the attacker demanded money and threatened to continue manipulating customer accounts and release customer information, and threatened further unauthorised orders in customer accounts at more than 70 domestic and overseas securities and FX firms. GMO says the threats also cover customer and company data disclosures and ransomware attacks. That is a threat concerning accounts, not confirmation that 70 brokers were hacked. GMO says it will not comply with the demands, will respond in coordination with police and other authorities, has submitted evidence to police, and has asked financial firms to block connections from the affected service and terminate active sessions.

What traders are owed

GMO will pay every current service customer ¥5,000 as a goodwill gesture, separately from compensation for qualifying realised trading losses and fees that GMO confirms resulted from unauthorised transactions. Ordinary market losses, lost potential profits and indirect damages are excluded. Eligibility depends on GMO’s review of trading and access records. Broker refunds will be deducted to avoid double recovery, but a broker’s refusal to refund does not itself disqualify an otherwise eligible claim. GMO will email eligible current customers by 23:59 JST on Friday 30 October with the procedure for receiving the goodwill payment and its payment schedule, with the claims process and payment timetable to follow by 6 November. The compromised infrastructure will not restart unchanged: customers will be offered an alternative service on independent infrastructure, free for six months.

The individual losses reported so far are broadcaster accounts, not a company-verified total. TBS NEWS DIG reported that a 44-year-old customer lost about ¥4.16 million in roughly two seconds through trades he said he had not authorised. Nippon TV reported that a Tokyo customer in his 30s lost about ¥3 million in four seconds. The reported cases include losses from unauthorised trading activity. GMO has not published a complete breakdown of all affected accounts or loss mechanisms. Access to a brokerage account can expose its balance to losses even when an intruder cannot directly transfer the money out.

What to do if you ran traders on Onamae

  1. Change credentials stored on GMO’s servers, and change any reused passwords.
  2. Change credentials from a separate device and end existing trading sessions, since changing a password alone may leave an already authenticated connection active.
  3. Check trade history and report suspicious trades, and watch for phishing.

OANDA Japan separately asked clients who ran its MT4/MT5 on the service to change their My Page and MT4/MT5 passwords, enable two-factor authentication on MT4/MT5, check trade history and report suspicious trades. Its withdrawal hold covered requests submitted on 22 October only; requests received by 11:00 on 22 October were to be paid out from 11:00 on 23 October. OANDA Japan says client assets are segregated by law.

What to watch next

Two dates are fixed: goodwill-payment details by 30 October, and the claims process and payment timetable by 6 November. Beyond those, the open questions are the verified-loss total, the attack method, and when, if ever, Desktop Cloud restarts. GMO has set no restart date and, as of the 25 October reporting, had not quantified the earnings impact.

Frequently asked questions

Was my money stolen? Reported cases include losses from unauthorised trading. Whether an individual account was affected, and how, depends on the account records and GMO’s investigation.

Is the whole of GMO hacked? No, on the current notices. They concern the Onamae.com Desktop Cloud service only. Nothing in them covers GMO’s entire internet business, its cryptocurrency exchange, or brokers’ own systems.

Will I get the ¥5,000? Every current service customer is due the goodwill payment, separately from any verified-loss compensation. Details are due by 30 October, with the claims process to follow by 6 November.

Sources

Related reviews and guides