AvaTrade Japan has confirmed that unauthorized parties accessed customer trading accounts and executed trades without permission, marking a significant escalation in the security concerns surrounding third-party virtual private server (VPS) services used by foreign exchange traders.
In an October 22, 2026, disclosure, the Japanese brokerage acknowledged that unauthorized access, logins and trading activity had occurred in some accounts belonging to customers using external services, including VPS providers.
The broker said it had not identified evidence that customer credentials or personal information had leaked from its own systems. However, it confirmed that the handling of affected customers remained under discussion with relevant parties, leaving unresolved whether unauthorized transactions will be reversed or customers compensated for any resulting losses.
AvaTrade did not disclose how many accounts were compromised, the value of unauthorized transactions, or whether any customers suffered confirmed financial losses.
AvaTrade Confirms Unauthorized Trades and Orders Immediate Password Changes
In its October 22 security notice, AvaTrade Japan explicitly acknowledged three forms of unauthorized activity: third-party access, account logins and trading transactions.
The confirmation goes beyond a precautionary warning about potentially exposed passwords. It establishes that unauthorized activity reached the execution stage in at least some customer accounts.
AvaTrade instructed customers to immediately change passwords for both its account-management portal and MetaTrader 4 and MetaTrader 5 trading platforms.
Customers were also advised to review their login histories, examine transaction records for unfamiliar trades and check whether they had received notifications about logins from unusual devices.
The broker specifically urged customers using external VPS services to review security notifications issued by those providers and contact AvaTrade support if they discovered suspicious activity.
AvaTrade said it would examine potentially affected accounts individually before informing customers about the next steps. It also apologized for the disruption and confirmed that its investigation was continuing.
The company had separately warned customers on October 9 about increasing attempts to access trading accounts using credentials exposed through external services. That earlier notice did not establish a connection to the incidents confirmed on October 22.
GMO Cyberattack Exposes Wider Risks for Automated FX Traders
AvaTrade’s disclosure coincides with a major security incident involving GMO Internet’s Onamae.com Desktop Cloud, a Japanese VPS service designed for running automated foreign exchange trading software.
As previously reported by Dave Finances, GMO Internet shut down its FX trading VPS service following a cyberattack after discovering malicious programs inside some customer server environments.
GMO began investigating on October 19 following a customer inquiry and confirmed the installation of unauthorized software on October 20. From October 21, it started suspending servers across all Desktop Cloud plans.
In an October 22 update, GMO said as many as 26,739 servers could potentially have been affected. The company also acknowledged receiving customer reports of unauthorized operations involving trading accounts and said credentials stored within the compromised environments may have been accessed.
GMO consulted police on October 22 and continued investigating with an external cybersecurity company. A date for restoring the affected service had not been announced.
Importantly, the 26,739 figure represents potentially affected GMO server environments, not confirmed compromised AvaTrade accounts. AvaTrade’s disclosure refers more broadly to customers using third-party services and does not explicitly attribute every affected account to Onamae.com.
Another Japanese brokerage, OANDA Securities, issued an October 22 warning specifically referencing the GMO incident and advising customers using its MT4 and MT5 platforms through the affected VPS service to change passwords and review their transactions.
Customer Losses and Reimbursement Terms Remain Undisclosed
The biggest unanswered question is what happens to customers whose accounts were used to execute unauthorized trades.
AvaTrade’s announcement did not establish whether the suspicious transactions generated profits, losses, margin calls or forced liquidations.
Nor did it outline a compensation mechanism, a deadline for processing claims or criteria for determining whether individual trades would qualify for reversal.
The brokerage said its response remained under discussion with relevant parties and that affected customers would receive individual guidance following a review of their circumstances.
That uncertainty is particularly important because unauthorized activity in a leveraged trading account can create financial exposure even when no funds are withdrawn.
Why Unauthorized Trading Creates a More Serious Problem Than Stolen Credentials
The distinction between stolen credentials and executed transactions is central to this incident.
A compromised password creates an opportunity for misuse. An unauthorized trade means someone has already crossed that threshold and exercised control over a customer’s market exposure.
In leveraged FX trading, the consequences can develop quickly. An attacker could open oversized positions, close profitable trades, interfere with an automated strategy or leave an account exposed to substantial losses during volatile market conditions.
Even if the customer eventually regains control, changing a password cannot undo transactions that have already affected the account balance.
This makes AvaTrade’s pending remediation decision more consequential than a routine password-reset exercise. The broker may need to establish which trades were unauthorized, when the suspicious access began and what financial impact resulted from those transactions.
The investigation also highlights a difficult question of responsibility when access credentials are potentially compromised through external infrastructure rather than the broker’s own systems.
That distinction has appeared in other Japanese brokerage security incidents. Dave Finances recently examined Mitsubishi UFJ eSmart Securities’ confirmed account compromises involving phishing and email-based authentication.
Unlike AvaTrade’s latest disclosure, however, that incident had not established unauthorized trading in the accounts covered by the warning.
Compensation Decisions Could Set an Important Precedent for FX Brokers
For AvaTrade, the immediate challenge is containing unauthorized access. The more difficult issue may be deciding who ultimately bears the financial consequences.
Where credentials were exposed through a third-party VPS, responsibility may depend on the technical findings, the broker’s security controls, customer agreements and applicable Japanese regulations.
It would be premature to assume that every disputed transaction will be cancelled or that customers must automatically absorb any losses.
The incident also raises questions about how brokers detect abnormal trading behavior. Unusual login locations, unfamiliar devices and abrupt changes in position sizes may provide warning signals, although their reliability depends on individual circumstances and the controls available.
Similar questions emerged in repeated unauthorized MT5 login allegations involving VT Markets, where a customer complained about account security procedures and disputed access. Those allegations remained unverified, unlike AvaTrade’s direct confirmation of unauthorized trades.
There is also a wider concern for automated trading. VPS services allow traders to run Expert Advisors continuously, but storing trading credentials within remote environments introduces another security dependency. A compromise at the hosting layer can potentially affect accounts maintained at otherwise separate brokerage firms.
For now, three developments will determine the seriousness of AvaTrade Japan’s incident: the number of affected trading accounts, the actual financial damage and the broker’s final position on reversing transactions or compensating customers.
Until those details emerge, the October 22 notice establishes a confirmed unauthorized-trading incident with unresolved financial consequences, rather than merely another warning about exposed passwords.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574