GMO Internet Group offered up to $1 million for information that leads to the identification and arrest of the hackers who breached its trading server service. The site where the attackers had posted customer data went offline early today (Wednesday).
The attackers began publishing what they said was customer data on Tuesday, after GMO refused a demand of about ¥8 billion (about $50 million). GMO said the domain was suspended at about 4:00 local time after it worked with other companies, and that it would move to take down any copies.
London’s trading industry is coming home!
Brokers hit by the breach are now tightening logins for every client, not only those who rented GMO’s servers. FXTF, which runs more than 280,000 accounts out of Tokyo, will lock clients out of its portal and platform from Saturday unless they switch on two-step login.
Brokers Make Two-Step Login Compulsory
FXTF already required one-time passwords on MT4 and MT5. Today’s notice extends the rule to its client portal and FXTF GX platform after weekly maintenance on October 31, and removes the option to close the setup window.
Codes go to the registered email address, so clients whose inbox cannot receive them will be shut out. FXTF, one of five brokers that confirmed unauthorized trades by Monday, becomes GW Securities on November 1.
Dukascopy Japan said today that some of its clients who used the GMO service had trades placed without consent. It changed passwords on accounts with suspected unauthorized logins and ended every open session, adding that it had found no sign its own systems were accessed.
OANDA Japan told clients on Tuesday that it is strengthening MT5 login security and asked those on rented servers to change the default remote desktop port and restrict which IP addresses can connect. OANDA plans to switch off MT4 on November 27.
XTB took the same step in Poland last year. It made two-step login compulsory for all clients hours after a customer said hackers had drained his account through rapid trades in thinly traded stocks.
GMO Says Costs Cannot Yet Be Calculated
In a filing to the Tokyo Stock Exchange today, GMO listed six kinds of payment linked to the breach. They include ¥5,000 for every user of the service, repayment of realized losses from unauthorized trades and a new PC for any customer hit by ransomware.
Customers whose data GMO confirms was published will get ¥10,000 to ¥25,000 for each category of information exposed, up to ¥3 million per disclosure. GMO said the total cannot be calculated until it knows how many customers qualify and what the published data covers.
GMO Internet Group is funding the bounty itself and began taking tips at noon. It said it “will never comply with the attacker’s demands” and is working with the police.
GMO Internet Group shares closed 5.2% higher than on Tuesday at ¥3,324, after a 15.7% fall on Monday. GMO has not said how many customers had data published. Up to 26,739 servers may have been exposed, it said last week.
Prime Minister Sanae Takaichi has asked her cabinet for emergency measures against cyberattacks by the end of next week, Bloomberg reported on Monday.
Account takeovers at online brokers were already a policy issue: fraudulent trades on hijacked accounts exceeded ¥500 billion between March and May 2025.
This article was written by Damian Chmiel at www.financemagnates.com.
