Key takeaways
- GMO Internet, part of Japan's GMO Internet Group, found malicious programs planted on customer servers of Onamae.com Desktop Cloud (お名前.com デスクトップクラウド) on October 20, 2026. The service is a Windows VPS that traders use to run MT4/MT5 and automated trading programs around the clock.
- Up to 26,739 servers may be affected. GMO stopped every server on every plan from 04:00 on October 21. There is no restart date.
- On October 22, GMO said login details for trading accounts saved in trading tools on the servers may have been taken and misused. Customers have reported unauthorized operations in their trading accounts.
- FX brokers have issued their own warnings. OANDA Japan reports unauthorized logins linked to the service. FXTF says an attack on "another company's VPS servers" may have led to logins and trades in some customers' accounts.
- After this week's unauthorized trades at Iwai Cosmo Securities, it is the second route this month by which attackers have reached Japanese investors' accounts without phishing them.
What happened#
| Date | Event |
|---|---|
| Oct 19 | A customer inquiry prompts GMO Internet to investigate |
| Oct 20 | Malicious programs confirmed on some customers' servers. New sign-ups and the control panel stopped |
| Oct 21, 04:00 | All servers on all plans stopped in turn, to prevent further damage. First public notice |
| From Oct 21 | Customers report unauthorized operations in their trading accounts. GMO shares information with the brokers concerned |
| Oct 22 | GMO consults the police and issues its second report |
GMO says it is investigating the entry route with a security firm. It holds no payment data on the servers.
What was at risk#
Traders use services like this to keep trading software running 24 hours a day without leaving their own computers on. To do that, the software stays logged in to the trading account, with the account's login ID and password saved in the tool.
That is what GMO now says may have been taken: "information stored on the servers, including trading account login information saved in trading tools." It asks customers to:
- Change the passwords of their trading tools and brokerage accounts urgently, from a device other than the affected server, and then log off to cut existing sessions
- Check trade history and balances, and contact their broker about anything they do not recognize
- Turn on two-step authentication where the broker offers it
- Change any other credentials kept on the server, and anywhere the same password was reused
The brokers#
Several FX brokers have warned their customers:
| Broker | What it said |
|---|---|
| OANDA Japan (registered in Japan) | Titled its notice "unauthorized logins etc. occurred" in connection with the service. Customers who ran its MT4/MT5 there may have had login details viewed. Asks for password changes and two-step authentication; its response policy is under discussion |
| FXTF (Golden Way Japan) | An attack "believed to have hit another company's VPS servers" may have exposed some customers' login IDs and passwords, with logins and trades possibly carried out. Does not name the service |
| AXIORY | Names the service; MT4/MT5/cTrader login details may have been viewed. No access to its own systems found |
| IS6FX | Names the service but says a link is not yet determined. Asks all customers to change passwords, and has restricted new orders until they do |
Gaitame Finest, a Japanese FX broker, separately reported unauthorized logins and trades on October 21 using credentials "possibly leaked from other services". It does not mention Onamae.com, and the link is not established.
What we don't know yet#
GMO Internet has not said:
- How the attackers got in, and whether it was through the platform or through individual customers' servers
- How many servers actually had malicious programs, as opposed to the 26,739 that may be affected
- How many trading accounts were misused, at which brokers, and how much money was involved
- Whether the attackers traded in accounts or also withdrew funds
- When the service will restart, and what customers' running positions should do in the meantime
Our analysis#
Credentials parked where trading runs unattended#
Japan's brokers spent 2025 pushing customers to multi-factor authentication after a wave of account takeovers. A trading VPS is where that protection is easiest to lose: the software must log in without a person present, so the password is saved on the server and the session stays open. In our view, an attacker who gets onto such a server does not need to defeat MFA at all. The broker sees a login from the usual place, with the usual software, at the usual time.
That makes services like this a concentration point: tens of thousands of servers, each holding live access to someone's trading account. It is the same pattern as Iwai Cosmo Securities this week, from a different direction: the customer's own login was strong, and the attacker went around it through a system the customer relied on.
A non-human identity problem#
A trading tool that logs in by itself is a small example of a problem that enterprises are now struggling with at scale: non-human identities. Service accounts, API keys, tokens, bots and the credentials that one system uses to log in to another all act without a person present. In our view, they share the weaknesses on display here: they cannot use the MFA built for people, they are often stored in plain reach of anyone who gets onto the machine, they are rarely rotated, and they frequently have more permission than the job needs.
This month's incidents in Japan keep returning to them. The website builder Studio lost its customers' API keys and tokens for other services. At Arcadia, a secret key for logins between services, read from a config file, opened the door. Digital Arts was entered with stolen operations credentials. Each time, the credential that mattered belonged to a machine, not a person. For security teams, the practical response is the same in every case: keep an inventory of non-human identities, give each the narrowest permission it needs, store secrets in a vault rather than on the host that uses them, rotate them, and alert on use from unexpected places.
Brokers have to treat the platform as part of their risk#
Several brokers moved quickly: warnings within a day, restrictions on new orders until passwords change, and pushes for two-step authentication. That is the right response. But in our view, brokers should also look at where their customers' automated trading runs. Logins from a known hosting provider's address range can be monitored; sessions can be cut and re-authenticated after an incident like this; and read-only or trade-only credentials, where a platform supports them, limit what a stolen login can do.
Shutting everything down#
Stopping all 26,739 servers is drastic for a service whose customers depend on it running. Automated strategies and open positions are left unattended. In our view, given that attackers were already using stolen credentials, it was the right call, in the same spirit as this week's precautionary shutdowns over PHP. The harder questions now are how the attackers got in and how customers will know a restarted server is clean.
What this means for readers#
- If you used Onamae.com Desktop Cloud, change your broker and trading tool passwords from a different device, log out all sessions, check history and balances, and turn on two-step authentication.
- If you run trading software on any VPS, assume the server holds keys to your account. Use a strong, unique password, enable broker-side protections, and review login alerts.
- If you are a broker, consider monitoring for logins from VPS providers after incidents like this, cutting sessions on request, and offering credentials with limited permissions for automated trading.
- If you run a hosting service, ask what your customers store on the machines you host. Here, the most valuable thing on each server was a login to someone else's service.
- If you manage enterprise systems, inventory your non-human identities, such as service accounts, API keys and tokens, and apply the same discipline you apply to people: least privilege, a vault, rotation and monitoring.
Japanese terms at a glance#
| Japanese | Reading | Meaning |
|---|---|---|
| デスクトップクラウド | desukutoppu kuraudo | Desktop Cloud (a Windows VPS service) |
| 自動売買 | jidō baibai | Automated trading |
| 取引ツール | torihiki tsūru | Trading tool (such as MT4/MT5) |
| 不正なプログラム | fusei na puroguramu | Malicious program |
| 不正な操作 | fusei na sōsa | Unauthorized operation |
| ログオフ（セッションの切断） | rogu-ofu (sesshon no setsudan) | Log off (cut the session) |
| 二段階認証 | nidankai ninshō | Two-step authentication |