GMO Internet Breach Hits OANDA Japan Withdrawals
Brokers whose clients run MetaTrader on rented third-party servers face a client-credential exposure they do not control, after a breach at GMO Internet Group’s Onamae.com Desktop Cloud. MetaTrader 4 and 5 (MT4 and MT5) are the platforms retail clients use to trade with brokers. Desktop Cloud is a virtual private server (VPS) service, a rented remote computer that keeps a platform running around the clock.
GMO Internet Group, listed on the Tokyo Stock Exchange Prime market under code 9449, stopped all Desktop Cloud plans from 4am yesterday after finding malicious programs on customer servers. It began investigating on Monday after customer inquiries and confirmed the malware on Tuesday. GMO says 26,739 servers are potentially affected, meaning they may be affected, not that each is confirmed compromised. It has not said when the service will restart.
In a second report today, GMO said customers had reported unauthorised operations on their trading accounts since yesterday. Login details for MT4, MT5 and trading accounts may have been viewed by a third party, and saved details may have been obtained and used. GMO asked customers to change passwords from a device other than the affected servers, then disconnect sessions. It has consulted the police, and a security firm is investigating how the intruder got in and how far access reached.
OANDA Japan told clients who ran its MT4 or MT5 on the service that their OANDA account ID and password may have been viewed. It asked them to change their My Page and platform passwords, switch on two-step authentication (a second check beyond the password), review trade history and contact support. It said it is still discussing future handling.
OANDA Securities Co., Ltd., which is registered with Japan’s Financial Services Agency (FSA), has also held withdrawals. Requests received by 11am today will be processed after 11am on 23 October 2026, with funds reaching clients’ bank accounts by 4pm that day. Requests received by 11am on 23 October 2026 follow the normal schedule. The notice cites unauthorised access at external services and does not name GMO. OANDA Japan described the hold as a precaution, and said client assets, meaning client money kept apart from the firm’s own, are strictly segregated under law and protected.
GMO says it has shared the situation with related businesses, which it does not name, and asked them to help notify customers. Any other broker whose clients host MT4 or MT5 on third-party servers may therefore carry the same exposure.
Each such broker has to decide whether to force password resets, require two-factor authentication or hold withdrawals as OANDA Japan has. If unauthorised trades do occur on client accounts, questions from regulators about client protection could follow. No regulator has made a statement.
Sources
GMO Internet/Onamae.com first report on Desktop Cloud, 21 October 2026
GMO second report on Desktop Cloud, 22 October 2026
OANDA Japan client notice, 22 October 2026
OANDA Japan withdrawal notice, 22 October 2026
