Hackers Publish Alleged GMO Customer Data as Broker FXTF Shuts Out Overseas Logins

FXTF, one of the Japanese brokers whose clients had trades placed without consent, blocked every login from outside Japan. The material appeared online at about 12:30 local time, half an hour after the attacker's deadline, GMO said. It had told users to back up files, disconnect their PCs and unplug them before noon, and said that as of 13:55 it had not confirmed a ransomware attack.

FXTF's block covers all its clients, not only those who used the GMO service. Anyone running MT4 or MT5 on a server rented abroad can no longer log in, in a market with more than 3 million active retail FX accounts. London's trading industry is coming home!

The attacker demanded about ¥8 billion (about $50 million) in an email on October 21, the day GMO suspended the service, according to GMO's timeline. A day later, OANDA Japan held client withdrawals for security checks. FXTF Shuts Out Overseas Servers The brokers that found unauthorized trades have so far acted on individual accounts.

FXTF has now acted on location. The broker, which runs more than 280,000 accounts out of Tokyo, had already limited access from abroad. On Tuesday it cut off overseas IP addresses from MT4, MT5 and its FXTF GX platform, citing efforts to keep "a safe and secure trading environment." A second FXTF notice said it may suspend trading on accounts that could have been reached through the GMO service, and switch on one-time passwords for them, to limit further damage and help the investigation.

OANDA Securities restricted trading on affected accounts yesterday (Monday) and plans to make passkeys compulsory. Gaitame Finest restricted accounts on October 21 and slowed withdrawals for extra checks. Dukascopy Japan said on Friday that restrictions were under consideration.

Of 11 Japan-licensed brokers whose notices FinanceMagnates.com has reviewed since October 21, FXTF is the only one to block a whole region. Five FX Firms Reported Affected Customers Finance Minister Satsuki Katayama said five FX firms had reported customers affected by the incident, Bloomberg reported, matching the five brokers that disclosed unauthorized trades by Monday. She said she had received no reports of new unauthorized transactions.

Prime Minister Sanae Takaichi told her cabinet on Monday to draw up emergency measures against cyberattacks by the end of next week, according to Bloomberg. GMO shares fell the most since 2011 the same day. Account takeovers were already a policy issue.

Fraudulent trades on hijacked accounts exceeded ¥500 billion across nearly 6,000 incidents between March and May 2025, the Financial Services Agency (FSA) said at the time. Marito Ueda, president of SBI FX Trade, said active FX traders appeared to have stayed, "as trading volumes have not declined," according to Bloomberg. FM Intelligence tracks quarterly volumes at brokers including OANDA and FXTF in its broker volumes tool.

MetaQuotes Says Its Platforms Were Not Breached MetaQuotes, which develops MT4 and MT5, told brokers on Monday that neither the platforms nor the trading servers involved had been compromised. It blamed breaches at several third-party hosting and VPS providers, possibly through unpatched management systems, with PHP-based ones "particularly vulnerable." The notice named neither GMO nor any broker. Attackers got into rented servers running trading terminals and placed trades with the logins saved there, MetaQuotes said, and it urged brokers to check clients who use third-party VPS services.

The same notice promoted MetaQuotes' own hosting for trading robots, including a sponsored option under which brokers pay for clients' servers. Some brokers had already been changing how clients reach MetaTrader: OANDA Japan plans to switch off MT4 on November 27, a decision it tied to cybersecurity requirements in March. GMO Says Leaked Data May Be Inaccurate GMO said it has not verified the published material, some of which may be wrong, and will contact customers whose data it confirms.

It is preparing legal action against people who spread it and asked the public not to visit the sites, saying visitors' own information was taken. GMO is considering extra payments for customers whose data is confirmed published, on top of the ¥5,000 it already pledged to every user. It will publish how to claim compensation for realized trading losses by November 6.

Paying the attacker would not guarantee the data is deleted, GMO said. ION faced the same choice in 2023. After LockBit hit the trading software firm, the hackers told Reuters the ransom had been paid, which ION declined to discuss.

GMO and its partners have collected PCs from customers across Japan for analysis. None examined by late morning showed malware, GMO said, adding that this did not prove every device was safe. Up to 26,739 servers may have been exposed, GMO said last week, adding that the figure was not a count of confirmed intrusions.

This article was written by Damian Chmiel at www.financemagnates.com.