Cloud hack hits Japan's FX traders

What happened

A hacker attack on a Japanese cloud service has hit traders who run automated forex (FX) trading tools. GMO Internet, one of Japan's largest domain registrars, said an unauthorised third party installed malicious programs on some customer servers of its Onamae.com Desktop Cloud service, according to BleepingComputer. Up to 26,739 servers may have been affected. The story was also among the top "hacker" searches in Romania this week.

How the attack worked

Desktop Cloud rents remote Windows servers that let traders run trading software such as MetaTrader around the clock. Many customers stored their broker logins on those servers. From 21 October, customers reported trades they had not made, The Next Web reported. GMO began shutting down servers on all plans early on 21 October and has not set a restart date. It said payment card details are kept on separate systems and were not affected.

Brokers react

Several Japanese brokers warned clients. OANDA Japan briefly held withdrawals as a precaution and asked clients who used the service to change their account and trading passwords, turn on two-factor login and check their trade history, Finance Magnates reported. It said client assets remain segregated, as Japanese law requires. Another broker, Gaitame Finest, said intruders had logged in and traded on some client accounts using passwords that may have leaked from other services.

Ransom demand and compensation

According to The Next Web, the attackers demanded payment and threatened to place unauthorised orders through accounts at more than 70 securities and FX firms, leak data and launch ransomware. GMO said it will not pay and has asked police to investigate. It will pay ¥5,000 to every current customer and cover realised losses from unauthorised trades, minus any broker refunds. GMO also asked the government to use Japan's new active cyber defence powers, which took effect on 1 October, against the attackers.

Why it matters for payments

The incident shows that the weak point is often not the bank or broker itself but a password stored somewhere else. The same lesson applies to anyone who uses a money transfer app, sends an international money transfer or keeps a crypto wallet. GMO told customers to change any passwords stored on the servers and on other services where they reused them, and warned that it never asks for passwords or card details by email or phone.

What to watch next

GMO plans to publish details on loss claims by 6 November and says it cannot yet estimate the cost to its earnings. The service will not return; customers can move to another GMO cloud service free for six months. Watch whether the government uses its new powers for the first time, and whether more brokers report unauthorised trades.

What it means for Odix Pay users

Use a unique password for your money apps and never share codes from your phone. Turn on every extra security step your apps offer, and if something looks wrong, contact the provider's support through official channels only. When you send money abroad with Odix Pay, check the recipient details before you confirm; the app shows the fee and exchange rate first. If you are paid from abroad, a personal virtual IBAN in your own name keeps incoming payments in an account you control. Availability depends on your country, and fees are shown in the app. More stories in the Odix Pay newsroom.