GMO Internet has shut down its Onamae.com Desktop Cloud service after detecting unauthorized third-party access and malicious programs inside some customer server environments, disrupting a virtual-server platform built specifically for traders running automated foreign-exchange strategies.
The Japanese internet infrastructure company said as many as 26,739 server environments could potentially be affected. Information stored inside the servers may also have been viewed by an unauthorized party, although GMO has not confirmed that all 26,739 environments were actually compromised.
The company discovered malicious programs in some customer environments on October 20 and subsequently moved to shut down servers across every Desktop Cloud plan from 4:00 a.m. Japan time on October 21 to prevent further damage.
GMO has not announced when the service will restart.
The scale and nature of the service make the incident particularly relevant to the FX industry. Onamae.com Desktop Cloud is marketed specifically as a VPS environment for automated foreign-exchange trading and supports MetaTrader 4 and MetaTrader 5. GMO says the service has accumulated more than 200,000 contracts.
GMO Says Information Inside Customer Servers May Have Been Viewed
According to GMO Internet’s official security disclosure, unauthorized access occurred against the Desktop Cloud service and malicious programs were installed in some customers’ server environments.
The company warned that information stored within those servers may have been viewed.
However, GMO drew an important distinction between information stored by customers inside their individual server environments and customer information held directly by the company.
As of its October 21 disclosure, GMO said it had not confirmed a leak of personal information entrusted to the company and had found no evidence that information potentially viewed during the intrusion had been misused.
GMO also said it does not retain payment information including customers’ credit-card details.
The investigation is continuing, and the company has not disclosed the attack vector, how long unauthorized access may have existed, what type of malicious software was installed or precisely how many of the potentially affected servers were actually accessed.
The company advised users who stored or used IDs, passwords or other authentication information inside their servers to change those credentials immediately. Customers who reused the same passwords elsewhere were also told to change them on those services.
GMO additionally warned customers to be alert for phishing emails or other fraudulent communications attempting to exploit the incident.
All Desktop Cloud Plans Were Taken Offline
The response goes substantially further than temporarily disabling a control panel or stopping new registrations.
GMO said servers across all Desktop Cloud plans would be progressively stopped, leaving customers unable to use the service while the investigation continued.
An emergency-maintenance notice initially published on October 20 had said maintenance would begin at around 9:00 p.m. and was expected to conclude around noon the following day. That notice was subsequently amended, with the expected completion time removed and server shutdown added to the impact.
The revised position is that restoration will be announced once a restart schedule can be determined.
That uncertainty matters because this is not an ordinary general-purpose hosting service for many of its users. GMO markets Desktop Cloud around continuous operation of FX automated-trading software, including MT4 and MT5 Expert Advisors.
The company says the service has recorded more than 200,000 cumulative contracts and advertises it as an environment allowing automated strategies to keep running without requiring a trader’s home computer to remain switched on.
The shutdown therefore potentially interrupts the exact function customers purchased the infrastructure to provide: persistent operation of trading terminals and automated strategies.
FX Robots Can Stop Even When Existing Broker Positions Remain Open
The immediate trading impact depends heavily on how each customer configured their strategy.
When a MetaTrader VPS goes offline, an Expert Advisor running inside that environment can no longer evaluate new market data, generate fresh orders or carry out strategy logic until the trading terminal is running somewhere else.
This does not necessarily mean every existing position becomes unmanaged. Stop-loss and take-profit instructions already placed with a broker are generally processed server-side and can remain active even when the customer’s MetaTrader terminal is offline.
But other functionality can depend on the terminal remaining connected. MetaTrader trailing stops, for example, operate inside the trading platform rather than on the broker server. An EA that dynamically modifies orders, closes positions, opens hedges or responds to indicators likewise cannot perform those functions while its host terminal is unavailable.
That creates a very different risk profile from a conventional website outage.
A customer may still have active positions at an FX broker even though the automated system intended to manage those positions has stopped running.
The incident also highlights how VPS infrastructure can become part of the security chain surrounding MetaTrader accounts. Dave Finances recently examined how VPS usage can complicate MetaTrader device identification in prop-trading environments.
In GMO’s case, the concern is more fundamental. If traders saved brokerage credentials inside a potentially affected Windows server, the possible exposure extends beyond whether an automated strategy continued running.
The Credential Risk Could Matter More Than the Temporary Trading Outage
The biggest unanswered question is what attackers could actually access inside the affected environments.
For many retail traders, a VPS is effectively a remote trading computer. It can contain installed MetaTrader terminals, Expert Advisors, configuration files, browser sessions and potentially authentication information associated with brokerage accounts.
GMO’s warning that customers should change IDs and passwords stored on their servers suggests the company considers credential exposure a possibility worth addressing, although it has not confirmed that brokerage credentials were stolen.
That distinction is critical.
A temporary VPS shutdown can be mitigated by moving an EA to another server or running MetaTrader locally. Stolen trading credentials create a potentially longer-lived problem because access may remain possible after the original server is restored unless passwords are changed.
Recent incidents in Japan have shown why unauthorized trading access deserves careful treatment. Dave Finances reported that Yutaka Trusty Securities detected unauthorized access during a futures-system disruption, although the company had not established broader customer-account compromise in that case.
Separately, Mitsubishi UFJ eSmart Securities confirmed unauthorized account access linked to phishing, showing how stolen authentication information can become a direct trading-security issue even without a breach of a broker’s own core systems.
The GMO incident is different because the potentially exposed environment sits between traders and their brokers rather than inside the brokerage itself.
The Attack Exposes a Hidden Concentration Risk in Automated FX Trading
For individual traders, VPS hosting often looks like a simple reliability tool: move MetaTrader off a home PC, keep the terminal online continuously and reduce the chance that a power or internet failure interrupts the strategy.
At industry scale, however, that model concentrates thousands of trading environments inside infrastructure operated by a relatively small number of hosting providers.
The benefit is operational continuity. The downside is that a sufficiently serious incident at the hosting layer can interrupt many independent trading systems simultaneously.
GMO’s figure of 26,739 potentially affected server environments illustrates that concentration unusually clearly. It does not mean 26,739 traders suffered financial losses, that every server contained an active EA or even that every potentially affected environment was successfully compromised.
But shutting the entire service down means customers dependent on it for continuous automation need another environment before their trading logic can resume.
The situation resembles a broader infrastructure problem seen when financial firms outsource critical services. Dave Finances previously examined the DriveWealth breach and its downstream impact on brokerage-platform customers, where an incident at an infrastructure provider reached users who interacted with financial services through other brands.
The same principle applies here in a different part of the trading stack. A broker can remain fully operational, MetaTrader can remain available and the forex market can continue trading normally while a trader’s automated strategy is effectively disconnected because the VPS layer has failed.
Restoration Alone Will Not Resolve the Main Questions
The next major update from GMO needs to establish considerably more than when the servers will switch back on.
The company still needs to determine how attackers gained access, what malicious programs were installed, when the intrusion began and whether information was actually extracted from customer environments.
Users will also need to know whether restored servers can be trusted or whether environments must be rebuilt from clean images before MetaTrader terminals and Expert Advisors are restarted.
For traders, the safest interpretation of the current disclosure is not that brokerage accounts have been compromised. GMO has not established that.
The more defensible conclusion is that credentials stored inside potentially affected servers should no longer automatically be treated as secret, which explains the company’s recommendation that affected users change them.
There is also a strategic lesson for automated traders. Using a VPS removes dependence on a home computer, but it does not remove infrastructure risk. It transfers that dependency to another machine, another network and another security perimeter.
That usually improves reliability. But when the hosting platform itself becomes the target, thousands of trading strategies can suddenly share the same point of failure.
Until GMO provides forensic findings and a clear restoration plan, the most consequential part of the incident is therefore not simply that an FX VPS went offline. It is that infrastructure specifically designed to keep automated trading systems running continuously became unavailable because the environment intended to improve trading resilience itself had to be taken offline for security reasons.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574