Overview
- GMO detected unauthorized access to its Onamae.com Desktop Cloud and suspended the service after receiving a roughly ¥8 billion ransom demand, and the company publicly refused to pay the extortionists.
- The attackers published material they say contains company and customer information shortly after a noon October 27 deadline and GMO is actively verifying the leak for authenticity.
- Brokers have restricted or suspended access to affected accounts after reports that leaked credentials were used to place unauthorized FX trades across more than 70 firms.
- GMO is collecting customer machines for forensic analysis, has pledged to reimburse verified trading losses and to pay every affected user ¥5,000, and it opened a bounty of up to $1 million for tips that lead to arrests.
- Officials and security vendors say the intrusion points to weaknesses in third‑party hosting and VPS setups rather than MetaQuotes’ MT4/MT5 platforms, and the incident has accelerated calls for stronger public–private cyberdefense and basic safeguards like multi‑factor authentication and patching.