A Japanese foreign exchange trader says she lost about ¥1.8 million after trades she did not recognize appeared in her brokerage account during the GMO cyberattack. GMO has promised compensation for eligible losses, but the total damage to customers remains unknown.

Key Takeaways

  • The Osaka trader said her balance fell from about ¥3 million to ¥1.2 million between October 21 and 22, 2026.
  • GMO plans to reimburse confirmed incident-related trading losses and fees, subject to investigation.
  • Up to 26,739 server environments may have been exposed, but that is not a count of compromised brokerage accounts.

GMO cyberattack reaches FX traders

The 37-year-old trader said she discovered the loss on October 22. Her transaction history included a sale of South African rand to buy euros that reportedly lost ¥1.19 million, along with other unfamiliar trades.

She had used Onamae.com Desktop Cloud, a GMO Internet service that lets customers run trading software on remote servers. Another customer, a 32-year-old man from Saitama Prefecture, reportedly lost approximately ¥550,000 through unauthorized transactions.

GMO said in an October 24 update that vulnerabilities had allowed unauthorized access to the service and that customer information had been taken outside the company. It has not published a total loss estimate or confirmed how many customers experienced unauthorized trading.

Compensation and service status

GMO said it will cover realized trading losses and associated fees where its investigation confirms that unauthorized transactions resulted from the incident. Ordinary market losses, hypothetical profits and indirect damages are excluded. The company will assess claims using records such as transaction histories and access logs, and may request further documents.

Customers are also being asked to consult their brokers about cancellations or refunds. GMO intends to deduct any broker refund from its compensation payment.

Separately, GMO plans a ¥5,000 payment to every current Onamae.com Desktop Cloud customer, regardless of whether they suffered losses. The service was suspended across all plans from October 21, with no restoration date announced in the latest updates. GMO has offered an alternative cloud service with six months of free access.

Threats and broker precautions

GMO said people believed to be responsible demanded money and threatened further unauthorized trading involving accounts at more than 70 securities and FX companies, as well as data disclosures and ransomware attacks. Those threats do not establish that all the companies were compromised. GMO said it submitted evidence to Japanese police and would not comply with the demands.

OANDA Securities Japan temporarily delayed some withdrawals as a precaution. AvaTrade Japan confirmed unauthorized account access and transactions involving customers who used external services, including virtual private server providers, but has not established a direct technical link between every affected account and GMO’s infrastructure.

Next milestone

GMO expects to announce goodwill-payment arrangements by October 30 and compensation application details by November 6.

Read More News

More FinanceVelix news

Disclaimer

This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.