GMO Asks Japan to Deploy New Cyber Powers After Forex Server Breach

GMO Internet Group has asked Japan's government to use its newly enacted active cyber defence powers against hackers who breached one of its trading services, according to The Next Web. The request, made in a stock exchange filing on a Saturday, followed threats to keep placing unauthorised orders through accounts at more than 70 securities and foreign-exchange firms in Japan and abroad.

Contents

01

How the breach unfolded

02

A first test for Japan's new cyber powers

03

Ransom demand and a suspended leak site

04

Trading volumes hold up, with some accounts closed

How the breach unfolded

The intrusion hit Onamae.com Desktop Cloud, a service that rents out Windows servers to traders who run automated forex tools such as MT4 and MT5 around the clock. MT4 and MT5 are widely used trading platforms that let a trader's software place orders automatically, which is why the logins stored on those rented servers matter so much. In an earlier incident report, GMO said up to 26,739 servers may have been affected. The intruders planted malicious software on some customers' servers, which may have exposed the trading logins stored there. From 21 October, customers began reporting trades they had not made.

The attackers then demanded payment, threatening to keep placing unauthorised orders through accounts at more than 70 securities and FX firms, to leak customer and company data, and to launch a ransomware attack. GMO said it will not pay, because payment would not guarantee that stolen data is deleted or stop its misuse. It has asked police to open a criminal investigation and warned that anything the attackers publish may be partly false.

GMO has also asked major exchanges and brokers to block access from the service and cut off all active sessions. On 22 October, OANDA Japan told customers that MT4 and MT5 logins used on the service may have been exposed, and briefly held withdrawals for a security check.

A first test for Japan's new cyber powers

In its filing, GMO asked state agencies to trace, block and neutralise the attackers' infrastructure, saying this would be the first use of the powers, which took effect on 1 October amid a wave of data leaks. Under the law, police and Japan's Self-Defense Forces can break into attackers' servers and disable them before damage spreads, Jiji Press reported. However, GMO is not among the critical infrastructure operators the law designates, according to Impress Watch.

For affected customers, GMO said it will pay ¥5,000 (about US$32) to every current customer of the service, whether or not they lost money, and will cover realised losses from unauthorised trades, minus any refunds from brokers. The service will not return. Customers can move to a separate cloud service free for six months, and GMO will publish details of the loss claims process by 6 November. The company said it cannot yet estimate the cost to its earnings.

Ransom demand and a suspended leak site

Hackers threatened to leak customer data of traders using GMO's forex trading service unless they were paid a ransom of around US$50 million, the company said on 27 October. GMO, which refused to pay, said on 28 October that the domain of a website the hackers used to publish data had been suspended.

Finance Minister Satsuki Katayama said five forex firms had reported customers affected by the GMO incident, and GMO sought government assistance to help disrupt the source of the attacks.

Trading volumes hold up, with some accounts closed

Japan's retail forex market has largely shrugged off the attack, with trading volumes holding up even as some investors close accounts, according to Central Tanshi FX's Takayuki Tominaga. "The impact on trading itself has been limited, with no signs of extreme moves," said Tominaga, head of market operations at the Tokyo-based retail forex broker. He had not observed large-scale withdrawals or account closures, while other traders said they had seen some closures.

Many Japanese retail currency investors tend to hold positions for longer-term carry trades, in which a trader borrows in a low-yielding currency to buy a higher-yielding one and earns the interest difference, making them resilient to short-term disruptions. Some hold high-yielding positions such as the Turkish lira and Mexican peso, entered at favourable levels, Tominaga said. "That makes them less likely to unwind on the latest turmoil alone. For now, most are staying on the sidelines," he said.

"Cyber risk is inherently persistent," Tominaga said. "Even after immediate vulnerabilities are addressed, repeated attacks or follow-on disruptions could prolong the fallout."

Finally, WikiFX would like to remind everyone that before using any US stock, futures, or forex brokers, remember to check the platform's regulatory information, trading environment, field inspection reports, user reviews, and overall rating on the WikiFX App. This will help you effectively avoid problematic scam platforms and rogue brokers, safeguarding your capital.