Five Japanese FX Brokers Confirm Hackers Placed Trades After Server Host Breach

OANDA Securities and FXTF said today (Monday) that hackers had placed trades on some client accounts. The intruders used MetaTrader logins taken from servers that traders rented from GMO Internet Group, and both brokers restricted trading on the accounts involved.

That brings to five the Japan-licensed brokers reporting unauthorized trades since the breach surfaced, after AvaTrade Japan, Gaitame Finest and Dukascopy Japan warned clients last week.

GMO said on Saturday it will repay realized losses on trades it confirms as unauthorized and pay ¥5,000 (about $32) to every current customer of the service.

London’s trading industry is coming home!

The attacker has threatened to keep placing orders on accounts at more than 70 securities and FX firms in Japan and abroad, GMO said, a claim FinanceMagnates.com could not verify. GMO will not pay and has asked police to investigate.

Five Brokers Found Trades, Others Only Warned Clients

The brokers’ notices split into two groups: firms that found trades their clients did not place, and firms that warned clients but found nothing on their own books.

FXTF, which runs more than 280,000 client accounts out of Tokyo, said several MT4 accounts were traded without their owners’ consent. It will make one-time passwords mandatory on MT4 and MT5 and tighten limits on access from abroad.

OANDA went further today than on Thursday, when it warned only that logins may have been viewed. The broker, which offered passkey logins as an option from June, said it will now make them compulsory.

The other three confirmed trades earlier. Gaitame Finest restricted affected accounts on October 21, and Dukascopy Japan confirmed unauthorized trades on Friday while saying restrictions were under consideration.

All five said their own systems showed no sign of a breach, unlike in 2020, when FOREX.com Japan said an unauthorized third party may have accessed its own network. None gave a count of affected accounts.

GMO Click Securities and GMO Gaika, both part of GMO Internet Group, warned clients on Friday but said they had found no unauthorized activity on their accounts. Offshore brokers Titan FX and Axiory posted warnings without reporting confirmed trades.

Of the nine broker notices FinanceMagnates.com reviewed, five reported trades on client accounts.

Regulator Asks Firms to Watch Trading

The Financial Services Agency (FSA) asked FX firms on Thursday, through the Financial Futures Association of Japan, to warn clients and closely monitor trading for suspicious orders, Nikkei reported.

Account takeovers have hit Japanese brokers before. Fraudulent trades on hijacked accounts exceeded ¥500 billion across nearly 6,000 incidents between March and May 2025, according to the FSA, and IG’s Japanese unit made two-factor authentication compulsory by June 2026.

Japan was the only one of Asia-Pacific’s three busiest broker markets where retail interest grew in the third quarter.

Organic visits to broker websites from Japan rose 18.5% from the second quarter to 6.6 million, while Asia-Pacific traffic fell 33%, FM Intelligence’s heat map shows.

GMO Will Not Restart the Servers

GMO said on Saturday that “a security problem existed” in the service’s own system, which let intruders in, and that customer information was taken out. It will not restart the existing servers. Customers can move to a replacement on a separate cloud, free for six months.

Repayment covers realized trading losses and fees. Market losses and lost profits are excluded, and any refund a client gets from a broker will be deducted, GMO said. It will publish how to apply by November 6.

OANDA told clients today to file claims with GMO directly and said it would help them gather trade records. Up to 26,739 servers may have been exposed, GMO said earlier, adding that the figure was not a count of confirmed intrusions.

OANDA is also due to switch off MT4 on November 27, a plan it set in March citing cybersecurity requirements.

This article was written by Damian Chmiel at www.financemagnates.com.