Dukascopy Japan Confirms Unauthorised FX Trades After Onamae Cloud Incident

Dukascopy Japan confirmed on October 28 that unauthorised trades had occurred in FX accounts belonging to customers who used Onamae.com Desktop Cloud, following unauthorised access to the third-party service.

The broker said it was working with GMO Internet Group to assess the situation and prevent further damage.

No Confirmed Breach of Its Own Trading System

Dukascopy Japan said it had not confirmed third-party unauthorised access to its trading system itself or information leakage from its systems at the time of the notice.

It had changed login passwords for accounts of Desktop Cloud users suspected of having experienced unauthorised logins.

OANDA Japan Also Reported Unauthorised Trades

BrokersView previously reported that OANDA Japan had restricted potentially affected accounts after confirming unauthorised trades.

In an October 27 notice, OANDA Japan said some accounts had been accessed using credentials that may have leaked through the same Desktop Cloud service. It said it had not confirmed customer-information leakage from its own trading systems or internal network.

Security Steps for Desktop Cloud Users

The broker asked customers who had used the service to:

• Run a full virus scan on their own devices.
• Back up important data.
• Log out again on each device as a precaution. Changing a login password terminates existing sessions on Dukascopy Japan’s system, but the broker still requested this additional step from a separate, secure device.
• Check linked apps, email-forwarding settings and browser extensions. Disable or remove unfamiliar items as appropriate, using a separate, secure device such as a smartphone or another PC.

Dukascopy Japan also warned that it would not request trading-account passwords or authentication codes by email or telephone, and urged customers not to pay anyone claiming they could recover lost funds.

GMO Maintains Refusal to Meet Attackers’ Demands

GMO said it would not comply with attackers’ demands because doing so would not guarantee deletion of the information obtained or prevent its misuse.

In a separate October 28 update, GMO Internet said a domain hosting information purportedly related to customers had been taken down at around 4 a.m. Japan time. It said monitoring and responses to any replacement sites would continue.

For questions about broker security or suspicious account activity, follow BrokersView Q&A.