A Japanese foreign exchange trader has reported losing approximately ¥1.8 million ($12,000) after unauthorized transactions appeared in her brokerage account during the cyberattack affecting GMO Internet’s Onamae.com Desktop Cloud service.
The 37-year-old woman from Osaka told Japanese news outlets that her trading balance fell from approximately ¥3 million to ¥1.2 million overnight on October 21–22. Her account history showed unfamiliar currency trades, including a large position involving the South African rand and the euro.
The customer account, published by Yomiuri Shimbun and Kyodo News on October 25, provides a clearer picture of the financial damage experienced by individual traders. It follows several days of disclosures about the cyberattack, including GMO’s October 24 announcement that it would compensate eligible customers for losses caused by unauthorized transactions.
The incident was already extensively reported before October 25, and the latest customer testimony is a follow-up rather than evidence of a newly discovered breach.
Unauthorized FX trades wiped out ¥1.8 million overnight
According to Yomiuri Shimbun, the Osaka customer discovered the losses when checking her FX trading account on the morning of October 22.
One unauthorized transaction, executed at approximately 12:40 a.m. local time, involved selling South African rand and buying euros. That trade alone reportedly generated a loss of ¥1.19 million. Other transactions and related position closures brought the total reported damage to approximately ¥1.78 million.
The woman had traded foreign exchange for roughly a decade and used GMO’s Desktop Cloud service for several years. The cloud-based product allows traders to operate automated strategies continuously without keeping their personal computers running.
Another customer, a 32-year-old man from Saitama Prefecture, reported losing approximately ¥550,000 through unauthorized transactions. Yomiuri also reported that he received an email from a group claiming responsibility for the attack and threatening to release customer information.
These are individually reported losses, not a verified total for all affected customers. GMO has not disclosed the aggregate financial damage or the number of brokerage accounts in which unauthorized transactions occurred.
GMO confirms data theft and outlines compensation
GMO Internet began investigating the incident on October 19 after receiving a customer inquiry. On October 20, the company identified unauthorized software inside some customer server environments and subsequently suspended all Desktop Cloud plans from October 21.
Up to 26,739 server environments were potentially exposed. That figure represents the number of servers within the affected scope, not a confirmed count of compromised brokerage accounts.
Dave Finances previously reported the initial shutdown of GMO’s FX trading VPS service and the risks associated with trading credentials stored on compromised remote servers.
In its October 24 compensation announcement, GMO confirmed that security weaknesses had allowed unauthorized access and that information had been taken from the service environment.
The company committed to compensating customers for realized losses resulting from transactions it determines were unauthorized and caused by the incident. Eligible amounts include trading losses and associated fees, but exclude ordinary market losses, hypothetical profits and indirect damages.
Customers will need to provide evidence of the disputed transactions. GMO said it would review trading records, access logs and other documentation before determining eligibility.
The company also announced a ¥5,000 goodwill payment for every current Desktop Cloud customer, regardless of whether that customer suffered financial losses.
Details of the goodwill payment process are expected by October 30, while instructions for compensation claims and payment procedures are scheduled for publication by November 6.
GMO additionally offered customers the option of migrating to a separate cloud infrastructure with six months of free service, rather than restarting the compromised platform without substantial security changes.
Attackers threaten further disruption across FX brokers
The incident has also developed into an extortion case.
GMO disclosed that individuals believed to be responsible for the attack demanded money and threatened to publish stolen information if the company refused.
The alleged attackers also threatened further unauthorized trading activity involving customer accounts at more than 70 securities and FX companies, alongside ransomware attacks and disclosures of internal infrastructure information.
Those statements describe threats attributed to the attackers, not evidence that all 70-plus companies were themselves compromised.
GMO said it would not comply with the demands and had submitted evidence to Japanese police. The company also requested government assistance involving active cyberdefense measures.
The incident has already affected the wider brokerage industry. AvaTrade Japan confirmed unauthorized customer trades involving accounts connected to third-party services, while emphasizing that it had not identified a breach of its own systems.
Meanwhile, OANDA Securities Japan delayed certain customer withdrawals as a precaution following the GMO incident. The temporary measures were intended to reduce the risk of unauthorized account activity rather than address an announced liquidity problem.
Why a VPS breach can become a direct trading loss
The financial consequences of this attack reveal an important distinction between conventional data breaches and compromises affecting trading infrastructure.
In many cybersecurity incidents, stolen passwords create the possibility of future financial damage. Here, the reported consequences reached the execution stage, with customers discovering positions they had never authorized.
A virtual private server used for MetaTrader trading can hold terminal settings, automated trading programs and the credentials needed to reconnect to brokerage accounts. If an attacker gains sufficient access to that environment, the attacker may be able to place orders without necessarily penetrating the broker’s underlying infrastructure.
That creates a particularly dangerous situation in leveraged FX trading.
An unauthorized market order can immediately expose an account to substantial currency movements. Depending on its size and available margin, the position may generate losses, trigger automatic liquidation or disrupt legitimate positions already held by the customer.
Unlike an ordinary unauthorized withdrawal, the loss may arise from transactions executed through normal market infrastructure. Reversing those transactions can be more complicated, especially when other market participants have already taken the opposite side.
Compensation promises leave important questions unanswered
GMO’s decision to cover qualifying realized trading losses is significant, particularly because the compromised infrastructure was not itself a brokerage.
However, the practical value of the compensation policy will depend on how quickly disputed trades are verified and how broadly eligible losses are interpreted.
For a trader who lost ¥1.8 million, a ¥5,000 goodwill payment is largely symbolic. The meaningful financial outcome depends on recovering the trading losses themselves.
There is also a difficult distinction between direct and indirect damage. A trader may have been forced out of legitimate positions, missed trading opportunities or experienced additional costs while the VPS platform remained unavailable.
GMO’s published policy does not promise compensation for every such consequence.
The company also expects customers to consult their brokers about possible transaction reversals or refunds. Where a brokerage returns part of the money, GMO intends to deduct that amount from its own compensation payment, preventing recovery of the same loss twice.
This arrangement makes sense financially, but it introduces another layer of administration for customers who may already be dealing with disputed account access and interrupted trading.
FX infrastructure providers face a wider trust problem
The larger issue extends beyond GMO and its immediate customers.
Retail traders increasingly rely on third-party technology to operate automated strategies, manage remote terminals and maintain uninterrupted access to global markets. These services are often treated as operational conveniences rather than critical components of account security.
The GMO incident demonstrates why that assumption deserves reconsideration.
A trader may use strong brokerage passwords and secure the broker’s account portal, yet still introduce a separate vulnerability by running trading software on a compromised remote server.
For VPS providers, this creates an expectation that their security controls should reflect the potential financial consequences of a breach, not simply the value of the hosting subscription.
For brokers, the incident raises questions about detecting unusual orders, terminating compromised sessions and communicating rapidly with customers when third-party infrastructure is attacked.
For investors evaluating GMO Internet, the immediate financial exposure remains difficult to estimate without knowing how many legitimate compensation claims will be approved. Beyond reimbursement costs, the company faces remediation spending, potential customer departures and the challenge of rebuilding confidence in a security-sensitive product.
The next disclosures should clarify the verified customer loss total, the progress of reimbursements and whether GMO can establish the full scope and duration of the unauthorized access.
Until then, the October 25 customer accounts put a human and financial dimension on an already documented cyberattack. The incident is no longer simply about exposed servers or stolen credentials. It is about how quickly a failure in third-party trading infrastructure can translate into real losses for retail investors.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574