Overview
- GMO said on Oct. 24 that its FX automated‑trading service had been accessed by intruders who copied customer data and that some users experienced unauthorized trades and financial losses.
- The firm pledged to reimburse confirmed losses, will pay a flat 5,000‑yen goodwill payment to all users, suspend the affected service and offer a free alternative for six months.
- Attackers issued cash demands and posted a public extortion site and emails to victims, and security experts warn that visiting that site can leak visitor data and risk malware infection.
- Independent analysis by security firm S＆J indicates attackers likely used a compromised customer VPS to escalate to administrator‑level access and steal a ‘master key’ that let them reach many accounts.
- GMO has handed evidence to police and asked the government to apply newly available active cyber‑defence measures, while other Japanese firms have begun small user payouts as AI‑driven scanning and recent PHP vulnerability disclosures fuel a wave of attacks.