GMO Says Own Security Unit Flagged Flaw Before FX Server Hack

GMO Internet Group’s founder, Masatoshi Kumagai, told a Tokyo news conference on Monday that the group’s own security subsidiary had identified a vulnerability in April 2024 in the trading server business that hackers later broke into, according to Finance Magnates. The report from GMO Cyber Security by Ierae did not climb the chain to senior management under the group’s internal information-sharing rules, Kumagai said.

The affected product, Onamae.com Desktop Cloud, leased Windows machines configured to run MetaTrader continuously. As many as 26,739 servers may have been exposed. Brokers confirmed that intruders used stolen login credentials to trade on client accounts, and the service has stayed offline.

Also read: PHP flaw shuts government sites as NSA urges patch

Key facts

• GMO Cyber Security by Ierae reported the vulnerability in April 2024; four rounds of emergency maintenance that April and May did not resolve the root cause, Kumagai said, as reported by Nikkei.
• Up to 26,739 servers may have been exposed, and the Onamae.com Desktop Cloud service remains shut down.
• Four executives will take pay reductions beginning with December compensation for three months: Kumagai gives up 30% of monthly pay, Tadashi Ito takes a 25% cut, and Hirofumi Yamashita and Kimihiro Kodama each take 20%.
• GMO has offered ¥5,000 (about $31) to every user of the service and pledged to repay realized losses from unauthorized trades; it said the claims procedure would be published by Friday.
• The attackers threatened to release customer data unless paid by October 27 and began posting what they said was that data once the deadline passed.

Warning that stopped short of management

Kumagai’s account places the origin of the problem inside GMO’s own corporate structure rather than with an outside adversary alone. The security review flagged the issue years before the intrusion became public, yet the finding was not routed upward, and Kumagai said the group is now discussing changes to how information moves between units. He described the outcome bluntly, saying the warning could not be put to use in operating the service, according to remarks carried by Nikkei and Impress Watch.

The pay reductions fall on GMO Internet, the listed subsidiary that ran the service, and its senior officers: Ito is deputy to the group chief executive and president of the listed unit. In its filing, GMO said the reductions reflect its present assessment and that it will revisit how management should answer for the breach once the chain of events has been verified.

Also read: House panel calls Webull's China ties a security risk; stock drops 30%

What the breach cost users so far

GMO has said in a stock exchange filing that the total cost cannot yet be calculated. Its immediate remedies are the ¥5,000 payment per user and reimbursement of realized losses on trades the intruders placed. On the extortion side, Kumagai repeated that the group would not pay, even after the October 27 deadline came and went and the attackers began publishing material they claimed came from customer data.

Why it matters

The incident shows how a single internal routing decision can delay a fix in shared infrastructure that many brokers depend on. Because Onamae.com Desktop Cloud hosted MetaTrader servers for multiple firms, a flaw in one vendor’s product becomes a counterparty risk for every broker whose clients traded through it. The disclosure also shifts attention from the attackers to corporate governance: the finding existed inside the group before the damage did. Separately, the incident belongs to a pattern of self-hosted and payment infrastructure being targeted through weak points in software that operators run themselves; in a related development reported by Bitcoinist, the open-source payment processor BTCPay Server issued an emergency warning on November 1 after reports of unauthorized withdrawals from merchants’ hot wallets, with an attack vector affecting version 2.4.1 and earlier and no credible drain reports for version 2.4.7.

Separate glitches at two affected brokers

OANDA Japan and FXTF, both of whose clients were caught in the GMO breach, told customers on Monday about problems each said were unrelated to the hack. OANDA Japan said a failure at partner bank docomo SMTB Net Bank is blocking withdrawal instructions from clients who requested payouts between 11:00 on Friday and 11:00 on Monday; the bank has given no timeline for a fix. Payouts due Monday will be resent Wednesday without clients needing to reapply, OANDA said, the second delay in under two weeks after it held withdrawals for a day on October 22 following the GMO breach. New accounts requested since Friday will take three to four business days to open, the broker added, citing internal workload.

FXTF, which runs more than 280,000 accounts, said a configuration error caused its MT4 platform to run the client margin check at 13:30 instead of the usual 15:30 to 15:45 window. The check verifies whether an account holds more than 100% of required margin. FXTF apologised, said it would review its system settings and how they are managed, and did not give a count of affected accounts.

What to watch

GMO has said it will publish the claims procedure by Friday, which will show how affected users can seek repayment. Also watch the group’s follow-up on internal reporting changes and on management responsibility once it finishes verifying how the breach occurred.

Written by

StockPil Editorial

The StockPil Editorial desk covers stock markets, business, finance, forex and crypto. Our AI-assisted newsroom builds each article from published, linked sources, checks it for accuracy before it goes live, and our editors review published articles and correct anything that needs it.

Sources: Finance Magnates, Bitcoinist