GMO Founder Acknowledges Earlier Security Warnings After FX VPS Breach

GMO Internet Group founder Masatoshi Kumagai acknowledged on November 2 that security specialists within the group had identified problems in Onamae.com Desktop Cloud before the cyberattack that exposed customer information and led to losses in FX trading accounts.

Speaking at a news conference, Kumagai apologised to affected customers and said findings from GMO Cyber Security by Ierae had not been put into practice in operating the service. He also acknowledged shortcomings in the system’s security.

Internal Warning Preceded the Breach

According to Finance Magnates, citing Japanese reporting, the security subsidiary flagged a vulnerability in April 2024. Four rounds of emergency maintenance in April and May that year failed to resolve the underlying issue.

Kumagai said the report had not reached management under the group’s internal reporting rules. The group was reviewing how security information is shared, the report said.

Onamae.com Desktop Cloud provides remote server environments used to keep trading platforms and automated strategies running. The incident affected customers of several Japanese FX brokers.

OANDA Japan and Dukascopy Japan previously confirmed unauthorised trades in accounts belonging to users of the service. Both said their notices had not established a breach of their own trading systems.

Four Executives Face Temporary Pay Cuts

Finance Magnates reported that four executives would take compensation reductions for three months, beginning in December.

Kumagai’s monthly compensation will fall by 30%, while GMO Internet President Tadashi Ito will take a 25% reduction. Senior officers Hirofumi Yamashita and Kimihiro Kodama will each take a 20% cut.

The company said management accountability would be reconsidered after further verification of how the breach occurred, according to the report.

Customer Support and Fraud Risks

In an October 30 customer notice, GMO Internet said it had begun contacting subscribers directly about goodwill-payment procedures and an alternative service, including six months of free use.

The company has maintained its refusal to meet the attackers’ demands. It has also warned customers about phishing and unsolicited offers to recover their losses, stressing that it will not ask for passwords or authentication codes.

Investor Warning: Customers who used the affected service should follow their broker’s security instructions, change trading passwords from a secure device, enable available two-factor authentication and review account activity. Report unfamiliar trades promptly through official support channels. Do not disclose authentication codes or pay anyone promising to recover lost funds.

For broker security updates, investor protection information and questions about suspicious account activity, follow BrokersView Q&A.

Related Reading

• GMO Launches $1 Million Bounty as Japan FX Brokers Tighten Logins
• Dukascopy Japan Confirms Unauthorised FX Trades After Onamae Cloud Incident
• OANDA Japan Confirms Unauthorized Trades After VPS Breach, Restricts Accounts