Five Brokers Confirm Unauthorized Trades After GMO Cloud Breach Exposes 26,739 Servers

Published October 26, 2026, 1:45 PM PKT. Based on GMO Internet Group's incident disclosures of October 21 to 24, 2026 and OANDA Securities and FXTF broker statements of October 26, 2026 (primary sources), and TokenPost, Fazzaco, Longbridge and Japan Times reporting on the incident (secondary sources).

Five Japan-licensed foreign exchange brokers have now confirmed unauthorized trades on client accounts after a breach at GMO Internet Group's server hosting service, and the count rose again on Monday, October 26, 2026. OANDA Securities and FXTF said on Monday that hackers placed trades using MetaTrader logins taken from servers rented from GMO Internet Group, according to Fazzaco, and both brokers restricted trading on the affected accounts. They join AvaTrade Japan, Gaitame Finest and Dukascopy Japan, which warned clients last week, according to the same report. All five brokers said their own systems showed no sign of a breach, according to Fazzaco, which means the attack path ran through the rented cloud servers, not through the brokers themselves.

The Monday confirmations: OANDA and FXTF join three earlier brokers

OANDA Securities confirmed on Monday that unauthorized third parties accessed some customer accounts and placed trades using ID and password combinations that may have been exposed through an external server service, according to TokenPost. The broker limited trading on potentially affected accounts and said it had not established that intruders accessed its core systems or took data from them, according to the same report. OANDA did not disclose the number of accounts or trades involved or the amount of any losses, according to TokenPost. OANDA told clients on Monday to file claims with GMO directly and said it would help them gather trade records, according to Fazzaco.

FXTF, which operates more than 280,000 client accounts from Tokyo, said several MT4 accounts were traded without their owners' consent, according to Fazzaco. The broker will make one-time passwords mandatory on MT4 and MT5 and tighten limits on access from abroad, according to the same report. OANDA, which had offered passkey logins as an option since June, said it will now make them compulsory, according to Fazzaco. The earlier confirmations set the pattern: Gaitame Finest restricted affected accounts on October 21 and said on Friday that withdrawals may take longer than usual while it tightens checks, according to Fazzaco, and Dukascopy Japan confirmed unauthorized trades on Friday and said restrictions were under consideration, according to the same report.

The wider warning circle is larger than the five confirmed cases. GMO Click Securities and GMO Gaika, both part of GMO Internet Group, warned clients on Friday but said they had found no unauthorized activity on their accounts, according to Fazzaco. Offshore brokers Titan FX and Axiory posted warnings without reporting confirmed trades, according to the same report. SBI FXTrade and Invast Securities, citing unauthorized trades at other foreign exchange firms, asked clients on Monday to register passkeys and stop reusing passwords, according to Fazzaco. Gaitame.com said it plans passkey logins across its services around December, according to the same report.

The October 21 shutdown: 26,739 servers in the inspection scope

The breached service is Onamae.com Desktop Cloud, a Windows remote-desktop server service that retail traders use to run automated MetaTrader 4 and MetaTrader 5 strategies around the clock, according to TokenPost and Fazzaco. Credentials stored in that environment can provide access to accounts at separate brokers, TokenPost noted, which is why one cloud breach turned into unauthorized trades at five firms. GMO began suspending all Onamae.com Desktop Cloud plan servers at 4:00 JST on October 21, 2026, describing the shutdown as a preventive measure, according to reporting on the company's disclosures. The full-service suspension meant every customer running automated trading bots or active MetaTrader sessions on the platform lost access at the same time.

The figure at the center of the story needs careful reading. An October 22 update identified 26,739 servers as potentially affected, according to TokenPost, but that figure is not a count of confirmed intrusions or affected broker accounts. It represents the number of servers included in the scope of the inspection, according to reporting on GMO's disclosures. The confirmed facts are narrower and still serious: GMO identified a third-party malicious program installed within Onamae.com Desktop Cloud server environments, customers reported unauthorized operations on their trading accounts, and trading-account login credentials stored on those servers may have been viewed by the attacker, according to reporting on the company's official disclosure. By 10:50 p.m. ET on October 23 (02:50 UTC on October 24), GMO said its probe had identified security flaws, confirmed unauthorized access and found that customer information had left the company, according to TokenPost.

The timeline before the shutdown shows a slow start. The investigation began on October 19, 2026, after GMO received reports from customers about suspicious activity, according to reporting on the company's announcement. A day later, the security team discovered malicious software installed by unauthorized parties in the customer server environment, according to the same reporting. GMO immediately halted new registrations and access to the service management panel, then began gradually disabling all service servers on October 21 to prevent the attack from spreading, according to the same account. GMO said on October 22 that it had consulted police, engaged an external security specialist and begun reports and consultations with relevant regulatory authorities, according to reporting on its third update.

The compensation plan: verified losses plus 5,000 yen per customer

GMO announced on Saturday, October 24, 2026 that it will compensate customers who suffered losses from unauthorized transactions, according to reporting on the announcement. GMO will pay 5,000 yen, about $32, to every current Desktop Cloud customer regardless of financial loss, according to TokenPost and Fazzaco. The company will also cover eligible realized losses and fees from unauthorized trades it verifies were caused by the incident, according to TokenPost. Market-movement losses, missed profits and indirect damages are excluded, according to the same report. GMO said it will pay even if a broker refuses to refund a client, according to Fazzaco, and it will publish how to apply by November 6, according to the same report.

The company also drew a hard line on the existing infrastructure. GMO said it will not restart the existing servers, according to Fazzaco, and customers can move to a replacement on a separate cloud, free for six months, according to the same report. GMO has asked major exchanges and securities firms to block access from the service and cut all active sessions, according to Fazzaco. GMO also said it will not pay the attacker, according to Longbridge, after the attacker demanded money and threatened to keep placing orders on accounts at more than 70 securities and foreign exchange firms in Japan and abroad, a threat claim Fazzaco noted could not be independently verified. GMO has reported the matter to police, according to Fazzaco.

One reassurance in the disclosures matters for anyone holding payment details on GMO services. Credit card information and other payment details were stored on separate infrastructure and were not affected by the incident, according to BleepingComputer reporting cited by Japan Times coverage. The exposed material, by contrast, is the dangerous kind for traders: login credentials that unlock live trading accounts, not just names and addresses. That distinction explains why brokers moved to passkeys and one-time passwords within days rather than treating this as a routine data leak.

The warnings ignored: the CEO admission and the regulator's move

On October 25, 2026, group founder and CEO Masatoshi Kumagai acknowledged that internal security specialists had identified weaknesses before the intrusion, but the response lacked sufficient speed and depth, according to reporting on his statement. The admission adds a management failure to an incident already affecting customers' access to their trading infrastructure, according to the same reporting. Kumagai also requested government assistance under Japan's active cyber defense laws, according to Longbridge, and GMO Internet urged the government to strengthen active cyber defense after the attack, according to Japan Times reporting.

The regulator moved before the Monday confirmations. The Financial Services Agency asked foreign exchange firms on Thursday, through the Financial Futures Association of Japan, to warn clients and closely monitor trading for suspicious orders, according to Nikkei reporting cited by Fazzaco. Account takeovers have hit Japanese brokers before: fraudulent trades on hijacked accounts exceeded 500 billion yen across nearly 6,000 incidents between March and May 2025, according to the Financial Services Agency figures cited by Fazzaco, and IG's Japanese unit made two-factor authentication compulsory by June 2026, according to the same report. The GMO breach therefore lands on a regulator already tracking a takeover wave, not on a clean slate.

What traders should do now: credentials, passkeys, and the November 6 deadline

The practical advice from the incident is unusually specific, because the brokers themselves spelled it out. Change every password that was stored on an Onamae.com Desktop Cloud server, and do not reuse it anywhere else, since GMO warned that customers whose servers contained passwords or other sensitive credentials should change them promptly, according to Japan Times reporting. Register passkeys or one-time passwords where the broker now offers them, since OANDA, FXTF and Gaitame.com all moved toward compulsory passkeys or one-time passwords in their Monday and Friday statements. Check trade history for orders placed without consent, and file claims with GMO directly, since OANDA told clients on Monday to do exactly that and GMO will publish the application process by November 6.

For crypto traders, the lesson crosses over even though this breach hit foreign exchange accounts, not a crypto exchange. Automated strategies that live on rented servers hold the keys to live accounts, and a breach of the server is a breach of the account, whatever asset the account trades. The brokers' own systems were not breached, yet customer money still moved, because the credentials were the weak point. Anyone running bots on a virtual private server, for crypto or anything else, should treat that server as part of the exchange account's security perimeter, with unique credentials, hardware-backed second factors where available, and withdrawal allowlists that stop a hijacked session from emptying the account.

This article is news reporting and is not investment advice.

Sources

• GMO Internet Group, Onamae.com Desktop Cloud incident disclosures (October 21 to 24, 2026), primary source
• OANDA Securities and FXTF broker statements (October 26, 2026), primary source
• TokenPost, OANDA Confirms Unauthorized Trades After GMO Cloud Incident (October 26, 2026), secondary source
• Fazzaco, Five Japanese FX Brokers Confirm Unauthorized Trades After GMO Server Breach (October 26, 2026), secondary source
• Longbridge, Japan's GMO Internet Cyberattack Puts 26,739 Servers at Risk as Company Promises to Cover Verified Trading Losses (October 26, 2026), secondary source
• Japan Times reporting on the GMO Internet incident and active cyber defense request (October 24 to 26, 2026), secondary source
• BleepingComputer reporting on the Onamae.com Desktop Cloud intrusion (October 21, 2026), secondary source