Unauthorized Access to GMO's VPS for FX Automated Trading May Have Affected Up to 26,739 Servers; Account Passwords Viewed and Reports of Unauthorized Trades

According to GMO Internet's announcement, an internal investigation began after a customer inquiry received on October 19, and on October 20 it confirmed that an unauthorized program had been placed in the server environments of some users. To prevent further spread, the company began sequentially shutting down servers across all plans from 4:00 a.m. on October 21 and has suspended new service sign-ups. In a second report dated October 22, it disclosed that the number of servers that could possibly be affected totaled 26,739 (all plans).

The problem is that the service was widely used as an operating environment for FX automated trading (trading tools such as MT4 and MT5). Login information and passwords for broker and FX accounts that were stored on the servers may have been viewed by third parties and improperly used. In fact, since October 21 users have reported unfamiliar operations on their trading accounts, and multiple news outlets including The Asahi Shimbun have reported on this. Claims of harm have also been posted on social media such as X (formerly Twitter), and the full extent of actual damage will need to await further investigation. The company has consulted the Tokyo Metropolitan Police and is working with a security specialist firm to investigate the intrusion route and scope of impact.

The company is urging users to: (1) urgently change trading tool and broker/FX account passwords from devices other than the affected servers, then log out of the relevant accounts; (2) check balances and trade histories and contact their broker if they find any unfamiliar trades; (3) enable two-factor authentication; and (4) change any other IDs and passwords that were stored on the server or any reused passwords. The company says credit card information is not stored on the affected servers. It is also warning users to be alert for phishing emails and fake sites exploiting the incident, and emphasizes that the company will not ask for passwords or card information by phone or email.

NHK has reported experts’ views that cyberattack targets are increasingly extending to financial institutions such as brokerages. Also within the GMO Group, it was reported earlier in the month that unauthorized access to the GMO Research & AI survey site "infoQ" resulted in the leak of information for about 948,000 members, raising questions about strengthening measures across the group. No date has been set for restarting the servers; resumption will be announced once safety is confirmed.