Five Japanese FX Brokers Confirm Unauthorized Trades After GMO Server Breach

Five Japan-licensed FX brokers have now reported unauthorized trades on client accounts following a breach at GMO Internet Group's server hosting service, according to company statements. OANDA Securities and FXTF said on Monday that hackers placed trades using MetaTrader logins taken from servers rented from GMO Internet Group, and both brokers restricted trading on the affected accounts. They join AvaTrade Japan, Gaitame Finest and Dukascopy Japan, which warned clients last week.

GMO said on Saturday it will repay realized losses on trades it confirms as unauthorized and pay ¥5,000 (about $32) to every current customer of the service. The company also said it will not pay the attacker, who demanded money and threatened to keep placing orders on accounts at more than 70 securities and FX firms in Japan and abroad—a claim that could not be independently verified. GMO has reported the matter to police.

FXTF, which operates more than 280,000 client accounts from Tokyo, said several MT4 accounts were traded without their owners' consent. The broker will make one-time passwords mandatory on MT4 and MT5 and tighten limits on access from abroad. OANDA, which had offered passkey logins as an option since June, said it will now make them compulsory. The other three brokers confirmed trades earlier: Gaitame Finest restricted affected accounts on October 21 and said on Friday that withdrawals may take longer than usual while it tightens checks; Dukascopy Japan confirmed unauthorized trades on Friday and said restrictions were under consideration.

All five brokers said their own systems showed no sign of a breach, unlike in 2020 when FOREX.com Japan said an unauthorized third party may have accessed its own network. None gave a count of affected accounts.

GMO Click Securities and GMO Gaika, both part of GMO Internet Group, warned clients on Friday but said they had found no unauthorized activity on their accounts. Offshore brokers Titan FX and Axiory posted warnings without reporting confirmed trades. SBI FXTrade and Invast Securities, citing unauthorized trades at other FX firms, asked clients on Monday to register passkeys and stop reusing passwords. Gaitame.com said it plans passkey logins across its services around December.

The Financial Services Agency (FSA) asked FX firms on Thursday, through the Financial Futures Association of Japan, to warn clients and closely monitor trading for suspicious orders, Nikkei reported. Account takeovers have hit Japanese brokers before: fraudulent trades on hijacked accounts exceeded ¥500 billion across nearly 6,000 incidents between March and May 2025, according to the FSA, and IG's Japanese unit made two-factor authentication compulsory by June 2026.

GMO said on Saturday it had found "a security problem in the system of the Service" and that customer information was taken out. It will not restart the existing servers; customers can move to a replacement on a separate cloud, free for six months. Repayment covers realized trading losses and fees, and GMO said it will pay even if a broker refuses to refund a client. Market losses and lost profits are excluded. It will publish how to apply by November 6.

GMO has asked major exchanges and securities firms to block access from the service and cut all active sessions. OANDA told clients on Monday to file claims with GMO directly and said it would help them gather trade records. Up to 26,739 servers may have been exposed, GMO said earlier, adding that the figure was not a count of confirmed intrusions. OANDA is also due to switch off MT4 on November 27, a plan it set in March citing cybersecurity requirements.