Five Japanese FX Brokers Confirm Hackers Placed Trades After Server Host Breach

OANDA Securities and FXTF said today (Monday) that hackers had placed trades on some client accounts. The intruders used MetaTrader logins taken from servers that traders rented from GMO Internet Group, and both brokers restricted trading on the accounts involved.

That brings to five the Japan-licensed brokers reporting unauthorized trades since the breach surfaced, after AvaTrade Japan, Gaitame Finest and Dukascopy Japan warned clients last week.

GMO said on Saturday it will repay realized losses on trades it confirms as unauthorized and pay ¥5,000 (about $32) to every current customer of the service.

London's trading industry is coming home!

The attacker has demanded money and threatened to keep placing orders on accounts at more than 70 securities and FX firms in Japan and abroad, GMO said, a claim FinanceMagnates.com could not verify. GMO will not pay and has gone to the police.

Five Brokers Found Trades, Others Only Warned Clients

The brokers' notices split into two groups: firms that found trades their clients did not place, and firms that warned clients but found nothing on their own books.

FXTF, which runs more than 280,000 client accounts out of Tokyo, said several MT4 accounts were traded without their owners' consent. It will make one-time passwords mandatory on MT4 and MT5 and tighten limits on access from abroad.

OANDA went further today than on Thursday, when it warned only that logins may have been viewed. The broker, which offered passkey logins as an option from June, said it will now make them compulsory.

The other three confirmed trades earlier. Gaitame Finest restricted affected accounts on October 21 and said on Friday that withdrawals may take longer than usual while it tightens checks. Dukascopy Japan confirmed unauthorized trades on Friday and said restrictions were under consideration.

All five said their own systems showed no sign of a breach, unlike in 2020, when FOREX.com Japan said an unauthorized third party may have accessed its own network. None gave a count of affected accounts.

GMO Click Securities and GMO Gaika, both part of GMO Internet Group, warned clients on Friday but said they had found no unauthorized activity on their accounts. Offshore brokers Titan FX and Axiory posted warnings without reporting confirmed trades.

SBI FXTrade and Invast Securities, citing unauthorized trades at other FX firms, asked clients today to register passkeys and stop reusing passwords. Gaitame.com said it plans passkey logins across its services around December.

Of the 11 broker notices FinanceMagnates.com reviewed, five reported trades on client accounts.

Regulator Asks Firms to Watch Trading

The Financial Services Agency (FSA) asked FX firms on Thursday, through the Financial Futures Association of Japan, to warn clients and closely monitor trading for suspicious orders, Nikkei reported.

Account takeovers have hit Japanese brokers before. Fraudulent trades on hijacked accounts exceeded ¥500 billion across nearly 6,000 incidents between March and May 2025, according to the FSA, and IG's Japanese unit made two-factor authentication compulsory by June 2026.

Japan was the only one of Asia-Pacific's three busiest broker markets where retail interest grew in the third quarter.

Organic visits to broker websites from Japan rose 18.5% from the second quarter to 6.6 million, while Asia-Pacific traffic fell 33%, FM Intelligence's heat map shows.

GMO Will Not Restart the Servers

GMO said on Saturday it had found "a security problem in the system of the Service" and that customer information was taken out. It will not restart the existing servers. Customers can move to a replacement on a separate cloud, free for six months.

Repayment covers realized trading losses and fees, and GMO said it will pay even if a broker refuses to refund a client. Market losses and lost profits are excluded. It will publish how to apply by November 6.

GMO has asked major exchanges and securities firms to block access from the service and cut all active sessions. OANDA told clients today to file claims with GMO directly and said it would help them gather trade records.

Up to 26,739 servers may have been exposed, GMO said earlier, adding that the figure was not a count of confirmed intrusions.

OANDA is also due to switch off MT4 on November 27, a plan it set in March citing cybersecurity requirements.