GMO Internet Pulled the Plug on All 26,739 Servers of Its FX-Trading Cloud Desktop After Attackers Planted Malware, Traded on Customer Accounts and Demanded $50 Million

GMO found the programs on October 20. At 4 a.m. Japan time the next morning it started switching customer servers off “in sequence to prevent further damage,” and it still hasn’t named a date to bring them back.

The service exists so a trading program never sleeps. It’s mostly used to run automated forex programs such as MetaTrader, and “one advantage is that it can run around the clock,” Impress Watch reported. A bot that trades all night needs to stay logged in to the broker all night, so the broker’s password lives on the server.

That’s what the attackers went after. GMO’s second report says trading-account login details stored on the servers “may have been obtained by third parties and misused,” and it asked customers to change those passwords from a different device and cut every live session. By the fourth report it had “confirmed that customer information was taken outside.”

The brokers felt it. OANDA Japan held back withdrawals as “a precaution against unauthorized payouts,” and Gaitame Finest said intruders “had logged in and traded on some client accounts,” Finance Magnates reported.

The ransom note arrived the same day as the shutdown. In his own blog post, GMO Internet Group founder Masatoshi Kumagai lists what it threatened: keep making unauthorized trades on customer accounts at more than 70 securities and FX firms in Japan and abroad, leak information from customers’ connected PCs and hit them with ransomware, leak GMO’s internal details, and pay “a demand for $50 million (about ¥8 billion).” GMO says it won’t pay and is working with the police.

Kumagai also says the hole wasn’t a surprise. “Issues needing improvement had been flagged to the field in advance by in-house white-hat hackers,” he writes, and he admits the response wasn’t deep or fast enough to close the gap.

What GMO is paying instead: a flat 5,000 yen to every current customer “regardless of whether they suffered financial harm,” compensation for confirmed losses from unauthorized trades, and a free six months on a replacement service. Impress Watch reports GMO will cover those losses even when a broker refuses to refund them.

It isn’t over. Kumagai’s timeline for October 27 has GMO asking customers to power off their PCs ahead of a deadline the attackers announced for noon, then posting a notice that afternoon about “the attacker’s public release of information.” What got published, and whose, GMO hasn’t fully said.

Expect brokers to stop treating “where does this login come from” as somebody else’s problem. A hosting company holding thousands of their customers’ credentials is now a known way in, so per-device keys, trading-only API tokens that can’t withdraw, and alerts on logins from known VPS ranges look a lot cheaper this week than they did last week.

The white-hat line will outlast the ransom note. A company that finds its own holes and then can’t move fast enough to fix them has a priority problem, and every security team that has filed a ticket and watched it sit just got a public example to point at.

Whether the government actually uses its new powers on behalf of a private hosting company, and how fast, is the next thing to watch.