GMO says up to 26,739 FX trading servers may be affected and ransomware is threatened, not confirmed

A reward worth 2 per cent of the demand, and a ransomware threat GMO has not confirmed was carried out

GMO Internet Group says it has set aside up to 1 million US dollars as a reward for information that identifies those behind the attack on its Onamae.com Desktop Cloud, a hosted Windows service that Japanese retail traders use to run automated FX trading. The group's chief executive says in a blog post that the attacker asked for 50 million US dollars, about 8 billion yen. The reward cap is therefore 2.0 per cent of the demand (derived: 1 million divided by 50 million), or 1.9 per cent if GMO's own reference rate of 150 yen to the dollar is used for the reward and the demand is taken as 8 billion yen (derived). GMO's notice of 27 October, its twelfth, says the reward is for lawful information that helps investigators and is not a ransom or a price for stolen data.

That figure does not establish who did it, how they got in, or that anyone is close to being caught. It also does not make the headline that travelled, that GMO told customers to shut down their PCs amid a ransomware threat, a story of ransomware. The word is accurate as a threat. GMO says the party it believes is the attacker announced a ransomware attack on customers' connected PCs for 12:00 Japan time on 27 October, and its later notices say no ransomware had been confirmed at 13:55 that day, that none had been found on the customer devices analysed by 11:59, and, in the fourteenth notice at 18:20 on 28 October, that analysis of the devices customers handed over has so far found no traces of malware infection or of a ransomware attack. What GMO does report is an intrusion into the hosting service, malicious programs on customer servers, theft of customer information, unauthorised trades in customers' broker accounts, an extortion demand, and a leak of data said to be GMO's and its customers'.

Read from about 18:30 JST (09:30 UTC) on Wednesday 28 October 2026. The source is GMO's own run of fourteen numbered notices on group.gmo, read in Japanese, with the first notice on onamae.com and the service's own product page. Translations in this briefing are this site's own, and the original wording sits in the saved copies and in the Technical details section. BleepingComputer's report of 27 October was read for what it adds and where it differs. The Hacker News page that carries a headline about the bounty answers a challenge and was not requested. The bounty's own site, cybercrimebounty.gmo, also answered a challenge, so its terms were not read. No UK angle was found, so this briefing has no UK section.

Stated and not stated: what GMO's notices say, line by line

The table sets what GMO's notices state against what none of them state. "Not stated" means not found in any of the fourteen notices, the first report on onamae.com, the chief executive's blog post or the service page, all read in full. It does not mean the information does not exist. The diagram after the table puts the same dates in order.

Zoom

Is it ransomware? What the word covers, and which PCs were told to shut down

Notice 4 lists three things the sender said would follow if GMO did not pay. First, the continued manipulation of customers' trading accounts at more than 70 brokers at home and abroad, by unauthorised orders that damage balances. Second, publication of information about the service and about customers' PCs connected to it, and a ransomware attack. Third, publication of information about GMO's own systems and operations. Notice 4 reports these as what GMO was told. They are a description of a threat, not a count of accounts hurt, and the 70 is the width of the threat, not a tally of firms with losses.

The instruction behind the headline is in notices 8, 9 and 10. Before 12:00 on 27 October, customers were asked to take a backup, cut the network, power down and unplug the cables of their PC. Notice 6 describes the devices it means as the customer's own PCs and phones that connected to the service. The hosted servers had already been off since 21 October, so the instruction was about customers' own machines, not the servers. GMO's notices do not say how an intruder on a hosted server would reach a connected PC, and no ransomware has been reported on one.

BleepingComputer's report says it "appears that the attacker never acted on their threat". GMO's wording is narrower: no ransomware was confirmed at 13:55, and notice 9 says the analysis "has not confirmed that every customer's device is safe" and continues as more devices arrive. By notice 14 (18:20 on 28 October) GMO says analysis of the devices handed in has found no traces of malware infection or a ransomware attack so far, and thanks customers who powered off, who may restart after a scan and a backup. That strengthens the reading that no ransomware ran on those devices, but it covers only the devices analysed. Whether ransomware was never launched, or has not been found, is not something the record can settle. BleepingComputer's text and GMO's differ in other places too, and the article follows GMO where they do.

Three payments and one reward: which is which

GMO names the 1 million dollar scheme the GMO Cybercrime Bounty, and a headline on The Hacker News, which was not read, also uses the word. The 5,000 yen figure is a goodwill payment to customers. They are different things and GMO's pages keep them apart. A bounty for information about the attackers is not paid to customers and is not paid to the attackers. The table lists every amount in GMO's notices with what it is and is not.

Three derived comparisons, each from figures printed above. The reward cap is 2.0 per cent of the demand. The demand is 50 times the reward cap (derived). The dollar and yen figures for the demand imply 160 yen to the dollar (8 billion divided by 50 million), while GMO's reward footnote uses 150, so the two do not come from one rate. The goodwill payment is 1.9 months of the cheapest plan's list price, 2,640 yen a month, and 0.7 of a month of the largest plan at 7,260 yen (derived from the service page). The three category amounts for published data add to 50,000 yen (derived). The notice does not define how a single publication is counted, so how often the 3 million yen cap would bind is not stated.

Interest, in one sentence: GMO runs the breached service, pays the compensation and the reward, and sells security services through its group, so each figure is a company's account of its own incident. Notice 14 says the scheme received 113 pieces of information in its first six hours, as of 18:00 on 28 October, and that the count will be posted on the reward site each weekday at 18:00. A count of tips is not a count of useful ones. The reward's terms were due to be published when it opened at 12:00 on 28 October, and they were not read, so who is excluded, how a share is decided and how it is paid are known here only from notice 12.

What the brokers say, and what the regulator's notice is reported to say

Two brokers' own pages were read in full. OANDA Japan's first notice, dated 22 October, says customers who used its MT4 or MT5 on the service may have had their account logins seen. A separate OANDA notice of the same day says it is holding withdrawals as a precaution: requests received by 11:00 on 22 October would be processed after 11:00 on 23 October, with funds arriving by 16:00. That notice speaks of an "external service" and does not name GMO. On 26 October OANDA's second report says some customers' accounts saw unauthorised logins and trades using ID and password pairs that may have leaked, and that possibly affected accounts were restricted and the customers contacted. Its third report points customers to GMO's compensation. On 27 October it said it found no leak from its own trading systems.

FXTF, run by Goldenway Japan, says on 26 October that it has confirmed several MT4 accounts affected, that those accounts' trading was temporarily restricted, and that withdrawals and restarts follow identity checks. It lists its measures: tighter limits on access from abroad, a mandatory one time password for MT4 and MT5, and mandatory multi factor and passkey sign in for its customer pages.

A difference between a broker's page and GMO's notice matters to anyone with an open session. GMO's notice 3 warns that after a password change some brokers' servers keep existing sessions for a period, so a third party can keep trading, and tells customers to cut every session. OANDA's own pages say a password change cuts all earlier sessions, including those from the old server. Both are statements about a particular broker's system, so whether a password change is enough depends on the broker, and the safe reading is to do both.

The regulator and police are covered by secondary reports only. A roundup by a Japanese security blog, which is a secondary source, says the Financial Services Agency notified FX firms through the Financial Futures Association of Japan on 22 October to warn customers and watch for unusual trading, citing Nikkei and Asahi reports. Neither the agency's home page nor the association's front page carried that notice when read, and neither newspaper was read, so the notice is unconfirmed here. GMO says it consulted police on 22 October at 13:00, and asked government bodies to apply active cyber defence measures, under a law its chief executive's blog describes as in force since 1 October. No government decision on that request was found. The same roundup lists notices from other brokers, including AvaTrade Japan, which was not read on its own page.

The layers, and the friendly names that stand in for controls

A trader on this service has three layers they can see: their own device, a hosted Windows desktop that runs MT4 or MT5 and the automated trading programs all day, and the broker that holds the account. The service page says customers connect with Microsoft Remote Desktop, and that the plans are 2, 4 and 8 gigabytes of memory with 150 gigabytes of storage. Everything else is a layer nobody has described: the hosting platform and control panel, the entry route, and the attacker. The diagram draws the known parts and leaves the rest as unknown.

Zoom

The last row is the most useful single admission in the record. The chief executive's blog says internal specialists pointed out issues with the service's security beforehand, the team was working on them, and that "the depth and speed" of the response were not enough. That is GMO's own account and it is an admission of a known gap. It does not say which issue was used, and the entry route is still not stated.

What the record does not establish

Entry route. GMO says there is a security problem in the service's system and that an outside firm is investigating. It does not say what, or whether anyone has found it.

First access date. The earliest dated event is a customer inquiry on 19 October. Confirmation on 20 October is the date GMO saw the programs, not the date they arrived. Whether the attacker was inside for days or weeks is not stated, and the demand email arrived on 21 October.

Whether the 26,739 are affected. The number is servers that may be affected, and GMO says so.

The cause of the unauthorised trades. GMO's wording is that they may follow from logins stored on servers being viewed. OANDA Japan and FXTF describe misuse of leaked logins. That is consistent with stolen stored credentials. It is not shown, and one other broker reported unauthorised trades without naming GMO, according to the roundup, so a link there is not made.

The scale of harm. No source gives a number of accounts, trades, customers or yen lost. Press reports of individual losses are secondary and were not read, and no private individual is named here.

The identity of the attacker. GMO says only a party believed to be the attacker. A press report quoted by the roundup says one customer received an email using a group name. Its link to the intrusion is not established, so the name is not repeated.

Technical details

GMO prints no indicators: no malware name, file name, hash, address, domain, port, account name, command or detection rule. It does not give the address of the site where the attacker published data, and this briefing did not open it. The only artifacts the primaries print are instructions to customers and a hardening list from one broker. They are copied below from the pages as read on 28 October 2026, with a translation that is this site's own beneath each one.

The first block is the instruction behind the "shut down PCs" headline, from GMO's notice 9 (page time 11:59 on 27 October). It applies to the customer's own PC, and was to be done before 12:00 that day. GMO's notices ask customers to handle the backed up files with great care, and a defender keeps the backup offline.

10月27日（火）12:00になる前に、バックアップを取得したうえで、ネットワークを切断、電源を落とし、PCにつながっているコードを抜いてください。

Before 12:00 on Tuesday 27 October, take a backup, then disconnect the network, power off, and unplug the cables connected to the PC.

The second block is from notice 3 (page time 16:10 on 23 October) on why a password change is not enough. It sits with the broker's own words on sessions, above. A defender asks the broker to terminate every session for the account, not only to reset the password, and does it from a device that never connected to the hosted server.

・パスワードを変更した後も、証券会社・FX会社等のサーバーの仕様によっては、一定期間、既存の接続セッションが維持され、第三者が継続的に取引できる場合があります。ご利用の証券会社・FX会社等の案内またはマイページ等をご確認のうえ、接続中の全セッションを切断するか、事業者窓口へ全セッションの切断をご依頼ください。すでにパスワードを変更済みの場合も、必ず実施してください。

After changing the password, depending on the specification of the broker's servers, existing connections may be kept open for a period and a third party may be able to keep trading.
Check the broker's guidance or account page and either disconnect all connected sessions or ask the broker's desk to disconnect all sessions.
Do this even if the password has already been changed.

The third block is the account protection list in notice 6 (page time 21:00 on 26 October). On this site's reading, each item closes a way back in that does not need the hosted server: a signed in session, a forwarding rule, a connected app, a registered device or a synced browser. A defender works through it from a clean device, from the official site and not from links in email or text messages.

・全端末・全セッションのログアウト（取引先のマイページまたは窓口で切断）
・FX・証券・メール・Googleなどのパスワードを変更してください
・多要素認証を有効にしてください
・心当たりのない連携アプリ・転送設定・拡張機能・登録端末は削除してください
・点検が完了するまでは、ブラウザの同期をオンにしないでください

Log out of all devices and all sessions (cut them from the broker's account page or desk).
Change the passwords for FX, brokerage, email, Google and similar.
Turn on multi factor authentication.
Delete any linked apps, forwarding settings, extensions or registered devices you do not recognise.
Do not turn on browser sync until the checks are complete.

The fourth block is OANDA Japan's advice of 27 October for customers whose VPS is someone else's service. It is a broker's list, not GMO's, and OANDA says its own measures do not reach the VPS. It is written for a remote desktop path, which the service page says this service uses. It does not say any of these was the route in this incident. A defender applies the list on any Windows VPS they control.

・RDPの接続ポートを変更する：デフォルトのポート番号（3389）を変更。自動化された不正アクセスの試行を軽減。
・接続元IPアドレスを制限する：Windowsファイアウォールで、ご自宅や職場など特定のIPアドレスからのみ接続を許可。
・アカウントロックアウトを設定する：ログイン失敗が一定回数を超えた場合にアカウントをロック、パスワードの総当たり攻撃から防御。
・Windows Updateを有効にする：OSのセキュリティ更新プログラムを常に最新の状態に保持。

Change the RDP connection port from the default port number 3389. This reduces automated unauthorised access attempts.
Restrict source IP addresses in the Windows firewall to specific addresses such as home or work.
Set an account lockout so that an account locks after a number of failed logins, as a defence against brute force password attacks.
Turn on Windows Update so that security updates are always current.

One more detail shows what GMO needs to see to judge a claim. Notice 4 asks claimants for a view only password for MT4 or MT5 so GMO can read the trade history, and says GMO will never ask for any other password. A defender who is asked for credentials during a claim checks that it is the view only kind, on the official page.

※ご本人様確認書類のご提出や、当社が直接取引履歴を確認するための専用パスワード（MT4/MT5ほかの閲覧専用パスワード等※1）のご提示を含め、具体的なご提出手順の詳細は、別途ご案内いたします。

Details of the specific submission steps, including submitting identity documents and presenting a view only password (such as for MT4/MT5) that lets GMO check the trading history directly, will be announced separately.

StartUp   2GB memory, 2 cores, 150GB SSD, 1 to 3 MT4/MT5, 2,640 yen a month
Standard  4GB memory, 3 cores, 150GB SSD, 6 to 8 MT4/MT5, 4,620 yen a month
Premium   8GB memory, 8 cores, 150GB SSD, 11 to 20 MT4/MT5, 7,260 yen a month

What to hunt, in plain words, from the record. Programs that your server did not install, and anything launched at logon or on a schedule. Broker sessions you did not start, and orders from an address you do not use. Remote desktop sign ins at odd hours. Saved passwords in the browser and in the trading platform. None of this is a GMO indicator. It is what the stated facts, programs on servers and stored logins used from outside, point to.

What to do, in the order worth doing

For anyone who runs trading or other sensitive work on a hosted VPS, and for the firms that hold the accounts. The order puts first what stops loss in the next hour.

If the incident touches you now, use GMO's channels from the official pages, never a link in an email or text, and treat any approach offering to recover lost money as a scam. GMO says it never asks for passwords or codes, and the leak site should not be visited: GMO says visitors' details were captured there.

What could not be verified

The Hacker News page and the reward's own site answered a challenge and were not requested, so the reward's terms and the headline's exact wording are not read. The 1 million dollar figure is GMO's own, from notice 12. The Financial Services Agency's notice, the Nikkei and Asahi reports, other brokers' pages, individual loss reports and the active cyber defence response are known only from a secondary roundup or not at all. The chief executive's 50 million dollar figure is from his blog post and the 8 billion yen from GMO's notices, and the screenshot of the demand in the blog was not read. GMO's times are as printed and one page carries a note that traffic caused some posting times to be corrected (notice 9), so exact minutes may shift. This briefing is current to the time of reading, and a later notice may change any statement above.

The question that exposes the gap

If your hosting provider shut every server tonight and the logins stored on yours were already in someone else's hands, how many minutes would pass before every broker session you hold was cut, and who has the list?

Key facts