GMO outlines compensation as FX brokers tighten security after cloud breach

Affects: The affected service is third-party hosting; compensation and security instructions depend on each provider’s confirmation.

GMO Internet Group founder Masatoshi Kumagai said the group would compensate verified losses from unauthorised trades linked to the Onamae.com Desktop Cloud breach. His statement says the ¥5,000 payment offered to service users is an initial payment, alongside six months of free replacement hosting. Compensation depends on the company confirming the connection to the incident.

Finance Magnates reported on 2 November that Kumagai acknowledged an April 2024 vulnerability warning from the group’s security subsidiary had not reached management. Four emergency maintenance rounds in April and May 2024 had failed to remove the underlying problem. Up to 26,739 hosted servers may have been exposed; that figure is not a count of confirmed affected trading accounts.

The report says Kumagai’s monthly remuneration will fall 30% for three months from December, with reductions of 25% for Tadashi Ito and 20% each for Hirofumi Yamashita and Kimihiro Kodama. GMO has refused the attackers’ ransom demand. The service remained offline in that report, and the total compensation cost had not been calculated.

Dukascopy Japan confirmed unauthorised FX trades involving some users of the cloud service on 28 October, while saying it had found no evidence of intrusion or data leakage in its own trading system. It changed passwords for accounts suspected of unauthorised logins. Clients were asked to scan devices, back up important files, end remaining sessions from a secure device, and check linked apps, email forwarding and browser extensions.

FXTF separately announced that two-step login would become compulsory for its client portal and GX platform after maintenance on 31 October, extending an existing requirement on MT4 and MT5. Codes are sent to registered email addresses. These broker responses concern account access and do not establish that MetaTrader software itself was breached.

A 28 October report says GMO offered up to US$1 million for information leading to identification and arrest of the attackers, funded by the group. The attackers had demanded about ¥8 billion and began publishing alleged customer data on 27 October. GMO said the hosting domain was suspended at about 04:00 local time on 28 October and that it would seek removal of copies. Taking down that site does not establish that all exposed data was recovered.

The same report describes further compensation categories: a replacement PC for customers hit by ransomware, and ¥10,000 to ¥25,000 per category of information confirmed as published, subject to a reported ¥3 million cap per disclosure. Those are reported scheme terms rather than an unconditional payment to every account holder. GMO said the total cost could not yet be calculated because the number of eligible customers and scope of the published data remained under assessment.

Sources

Editorial note

This page is an original multilingual editorial summary. It attributes and links to the source report instead of republishing the third-party article.