GMO Founder: Internal Security Unit Flagged FX Server Flaws in 2024

GMO Internet Group's own security subsidiary flagged a vulnerability in its MetaTrader hosting service in April 2024 — roughly 18 months before hackers breached it — and the warning never reached group management, founder Masatoshi Kumagai said at a Tokyo news conference on Monday.

The service, Onamae.com Desktop Cloud, rented out Windows servers running MetaTrader around the clock. Up to 26,739 servers may have been exposed. Brokers confirmed that attackers used stolen logins to place trades on client accounts. The service remains offline.

Subsidiary GMO Cyber Security by Ierae reported the vulnerability in April 2024, according to Nikkei. Four rounds of emergency maintenance in April and May that year failed to fix the underlying problem.

Why the warning went nowhere

The 2024 report did not move up the chain under the group's internal reporting rules, Kumagai said, and the group is now discussing how to change how information is shared. "We were unable to put it to use in running the service," Kumagai said, according to Nikkei and Impress Watch.

What does this change for desks using hosted MetaTrader infrastructure? For now, nothing operational — Onamae.com Desktop Cloud stays offline with no stated restart date, and the group says the total cost of the incident cannot yet be calculated.

Pay cuts land on four executives

GMO cut the pay of four executives, effective with December pay and running three months:

• Masatoshi Kumagai, founder: gives up 30% of monthly compensation.
• Tadashi Ito, deputy to the group CEO and president of GMO Internet, the listed subsidiary running the service: 25%.
• Hirofumi Yamashita and Kimihiro Kodama, senior officers of the same subsidiary: 20% each.

GMO said in a filing that the cuts reflect its current assessment and that it will reconsider how management should take responsibility once it has verified how the breach happened.

Kumagai repeated that GMO will never pay the attackers. The hackers had threatened to publish customer data unless GMO paid by October 27, and began posting what they claimed was that data after the deadline passed.

Client compensation: ¥5,000 per user

The group has already offered ¥5,000 (about $31) to every user of the service and promised to repay realized losses from unauthorized trades. It said it will publish the claims procedure by Friday. In a stock exchange filing last Wednesday, GMO said the total cost cannot yet be calculated.

Two brokers report separate disruptions

Two brokers whose clients were hit by the breach told customers on Monday about unrelated problems.

OANDA Japan said a system failure at its partner bank, docomo SMTB Net Bank, is blocking withdrawal instructions. Clients who requested payouts between 11:00 Friday and 11:00 Monday are affected, and the bank has given no timeframe for a fix. Payouts due Monday will be resent on Wednesday without clients reapplying. It is the second delay in under two weeks, after OANDA held withdrawals for a day on October 22 following the GMO breach. OANDA also said new accounts requested since Friday will take three to four business days to open, citing internal workload.

FXTF, which runs more than 280,000 accounts, said a setting error made its MT4 platform run the client margin check at 13:30 instead of the usual 15:30–15:45 window. The check tests whether an account holds more than 100% of required margin. FXTF apologized, said it will review its system settings and their management, and gave no count of affected accounts.

The claims procedure due by Friday is the next concrete milestone for affected traders, ahead of any verification findings on the breach itself.