Five Japanese FX Brokers Confirm Unauthorized Trades After Host Breach

Five Japan-licensed FX brokers have now confirmed that hackers placed trades on client accounts using MetaTrader logins stolen from servers hosted by GMO Internet Group, the trading infrastructure provider that now says it will repay realized losses and will never restart the compromised machines.

OANDA Securities and FXTF confirmed unauthorized trades on Monday. They join AvaTrade Japan, Gaitame Finest and Dukascopy Japan, which warned clients last week. Both firms that reported today have restricted trading on the affected accounts.

The breach sits at the layer between trader and broker: rented servers that run MetaTrader terminals. Every broker that filed a notice said its own systems showed no sign of intrusion. That separates this incident from the 2020 FOREX.com Japan case, where the broker itself said a third party may have accessed its network.

What does the breach actually involve?

GMO said on Saturday it found "a security problem in the system of the Service" and that customer information was taken out. Up to 26,739 servers may have been exposed — a figure the company stressed is not a count of confirmed intrusions.

The attacker demanded money and threatened to keep placing orders on accounts at more than 70 securities and FX firms in Japan and abroad, GMO said. The claim could not be independently verified. GMO refused payment and reported the matter to the police.

The company will not restart the existing servers. Customers can migrate to a replacement on a separate cloud, free for six months. GMO has asked major exchanges and securities firms to block access from the old service and cut all active sessions.

What will victims get back?

GMO's remedy, announced Saturday, covers:

• Realized trading losses and fees on trades it confirms as unauthorized
• A payment of ¥5,000 (about $32) to every current customer of the service
• Reimbursement even if a broker refuses to refund a client
• Exclusions: market losses and lost profits

GMO will publish its claims procedure by November 6. OANDA told clients on Monday to file claims with GMO directly and said it will help them gather trade records.

How are brokers responding?

The responses split into two groups: firms that found trades their clients did not place, and firms that warned clients but found nothing on their own books.

FXTF, which runs more than 280,000 client accounts from Tokyo, said several MT4 accounts traded without consent. It will make one-time passwords mandatory on MT4 and MT5 and tighten limits on access from abroad.

OANDA went further on Monday than its Thursday warning that logins may have been viewed. The broker, which offered passkey logins as an option from June, will now make them compulsory. It is also due to switch off MT4 on November 27 under a plan it set in March, citing cybersecurity requirements.

Gaitame Finest restricted affected accounts on October 21 and said Friday that withdrawals may take longer while it tightens checks. Dukascopy Japan confirmed unauthorized trades on Friday and said restrictions were under consideration. None of the five disclosed a count of affected accounts.

GMO Click Securities and GMO Gaika, both part of GMO Internet Group, warned clients on Friday but reported no unauthorized activity. Offshore brokers Titan FX and Axiory posted warnings without confirming trades.

SBI FXTrade and Invast Securities, citing the trades at other firms, asked clients on Monday to register passkeys and stop reusing passwords. Gaitame.com plans passkey logins across its services around December. Of the 11 broker notices reviewed by Finance Magnates, five reported trades on client accounts.

What is the regulator doing?

The Financial Services Agency asked FX firms on Thursday, through the Financial Futures Association of Japan, to warn clients and monitor trading closely for suspicious orders, Nikkei reported.

The context is not new. Fraudulent trades on hijacked accounts exceeded ¥500 billion across nearly 6,000 incidents between March and May 2025, according to the FSA. IG's Japanese unit has already made two-factor authentication compulsory by June 2026.

The market under pressure is, meanwhile, growing: organic visits to broker websites from Japan rose 18.5% quarter-on-quarter to 6.6 million in the third quarter, even as Asia-Pacific traffic fell 33%, according to FM Intelligence's heat map.

The claims window, the passkey deadlines and the November 27 MT4 shutdown at OANDA now form the timeline desks should watch.