OANDA's Japanese brokerage held back withdrawals requested today (Thursday) as a precaution against unauthorized payouts, after warning hackers may have seen some clients' MetaTrader logins. Client assets remain segregated as Japanese law requires, the broker said.
The logins were stored on Onamae.com Desktop Cloud, a rented server service run by Japan's GMO Internet Group. GMO Internet said yesterday (Wednesday) that a third party had planted unauthorized programs in customers' server environments, which it detected on Tuesday.
London's trading industry is coming home!
GMO began shutting down servers on every plan at 4 a.m. Wednesday and has not set a date for restarting them. Up to 26,739 servers may be affected, it said.
Retail FX traders rent the servers to keep MT4 and MT5 terminals and automated strategies running around the clock, and the MetaTrader logins stored on them belong to accounts at brokers such as OANDA.
OANDA Securities is already moving clients off MT4, which it plans to switch off on November 27, citing cybersecurity requirements when it set the timetable in March.
Two Other Brokers Report Unauthorized Trades
AvaTrade Japan said today that third parties had logged in to some accounts of clients who use outside services such as VPS servers and carried out unauthorized trades.
Gaitame Finest said on Wednesday that intruders had logged in and traded on some client accounts using IDs and passwords possibly leaked from other services. It has restricted the affected accounts. Neither broker named GMO, and both said their own systems had not leaked client credentials.
Dukascopy Japan asked all VPS users to change their trading passwords today, citing unauthorized access at another company's VPS service. That makes four Japanese brokers warning clients about account security since Wednesday.
Japanese Brokers Have Been Tightening Logins Since 2025
Japanese regulators have tracked account takeovers at online brokers since early 2025. Fraudulent trades on hijacked brokerage accounts exceeded ¥500 billion (about $3.2 billion) across nearly 6,000 incidents between March and May that year, according to the Financial Services Agency (FSA).
IG's Japanese unit made two-factor authentication compulsory by June 2026, saying unauthorized access attempts were rising across the industry. OANDA has required authenticator codes for withdrawals since December 2025.
MetaQuotes is changing how traders sign in, too. Its MetaTrader 5 beta build 6030 added unified client accounts secured with passkeys in July.
Payouts Due by Friday Afternoon
Withdrawals requested by 11 a.m. today will be processed from 11 a.m. on Friday, once security checks are complete, and should reach clients' bank accounts by 4 p.m., OANDA said. Requests made by 11 a.m. Friday follow the normal schedule.
The withdrawal notice cites unauthorized access at "external services" without naming GMO.
In a separate notice, the broker asked clients who ran MetaTrader on the GMO service to change their account and MT4 or MT5 passwords, turn on two-factor login in MetaTrader and check their trade history. It said it was still deciding how to handle the matter from here.
OANDA has been owned by Czech prop trading firm FTMO since FTMO agreed to buy it from CVC Asia Fund IV in 2025.
GMO Says Its Own Data Did Not Leak
GMO said that, as of its announcement, it had found no leak of personal information it holds and no misuse of data, and that it does not keep customers' card details. It told users to change any IDs and passwords stored on the servers and on other services where they reuse them.
GMO has suspended new sign-ups. Its service terms offer a refund or credit when monthly uptime falls below 99.99%, and it said it will announce how it will handle this outage once it decides.
The breach is the second security incident at GMO Internet Group this month. Masatoshi Kumagai, its chairman and chief executive, said on October 9 that all group services would be inspected after a data leak at a group research company, Nikkei reported.
OANDA's warning covers clients running either of MetaQuotes' two retail platforms on the service. MT5 carried 65% of retail CFD volume on MetaQuotes platforms in the first quarter of 2026, FM Intelligence data show, against 35% for MT4.
In Asia-Pacific, MT5 drew 1.5 million organic website visits in the third quarter, about twice the 709,700 for MT4, according to FM Intelligence's platform comparison.
OANDA's Japanese brokerage held back withdrawals requested today (Thursday) as a precaution against unauthorized payouts, after warning hackers may have seen some clients' MetaTrader logins. Client assets remain segregated as Japanese law requires, the broker said.
The logins were stored on Onamae.com Desktop Cloud, a rented server service run by Japan's GMO Internet Group. GMO Internet said yesterday (Wednesday) that a third party had planted unauthorized programs in customers' server environments, which it detected on Tuesday.
London's trading industry is coming home!
GMO began shutting down servers on every plan at 4 a.m. Wednesday and has not set a date for restarting them. Up to 26,739 servers may be affected, it said.
Retail FX traders rent the servers to keep MT4 and MT5 terminals and automated strategies running around the clock, and the MetaTrader logins stored on them belong to accounts at brokers such as OANDA.
OANDA Securities is already moving clients off MT4, which it plans to switch off on November 27, citing cybersecurity requirements when it set the timetable in March.
Two Other Brokers Report Unauthorized Trades
AvaTrade Japan said today that third parties had logged in to some accounts of clients who use outside services such as VPS servers and carried out unauthorized trades.
Gaitame Finest said on Wednesday that intruders had logged in and traded on some client accounts using IDs and passwords possibly leaked from other services. It has restricted the affected accounts. Neither broker named GMO, and both said their own systems had not leaked client credentials.
Dukascopy Japan asked all VPS users to change their trading passwords today, citing unauthorized access at another company's VPS service. That makes four Japanese brokers warning clients about account security since Wednesday.
Japanese Brokers Have Been Tightening Logins Since 2025
Japanese regulators have tracked account takeovers at online brokers since early 2025. Fraudulent trades on hijacked brokerage accounts exceeded ¥500 billion (about $3.2 billion) across nearly 6,000 incidents between March and May that year, according to the Financial Services Agency (FSA).
IG's Japanese unit made two-factor authentication compulsory by June 2026, saying unauthorized access attempts were rising across the industry. OANDA has required authenticator codes for withdrawals since December 2025.
MetaQuotes is changing how traders sign in, too. Its MetaTrader 5 beta build 6030 added unified client accounts secured with passkeys in July.
Payouts Due by Friday Afternoon
Withdrawals requested by 11 a.m. today will be processed from 11 a.m. on Friday, once security checks are complete, and should reach clients' bank accounts by 4 p.m., OANDA said. Requests made by 11 a.m. Friday follow the normal schedule.
The withdrawal notice cites unauthorized access at "external services" without naming GMO.
In a separate notice, the broker asked clients who ran MetaTrader on the GMO service to change their account and MT4 or MT5 passwords, turn on two-factor login in MetaTrader and check their trade history. It said it was still deciding how to handle the matter from here.
OANDA has been owned by Czech prop trading firm FTMO since FTMO agreed to buy it from CVC Asia Fund IV in 2025.
GMO Says Its Own Data Did Not Leak
GMO said that, as of its announcement, it had found no leak of personal information it holds and no misuse of data, and that it does not keep customers' card details. It told users to change any IDs and passwords stored on the servers and on other services where they reuse them.
GMO has suspended new sign-ups. Its service terms offer a refund or credit when monthly uptime falls below 99.99%, and it said it will announce how it will handle this outage once it decides.
The breach is the second security incident at GMO Internet Group this month. Masatoshi Kumagai, its chairman and chief executive, said on October 9 that all group services would be inspected after a data leak at a group research company, Nikkei reported.
OANDA's warning covers clients running either of MetaQuotes' two retail platforms on the service. MT5 carried 65% of retail CFD volume on MetaQuotes platforms in the first quarter of 2026, FM Intelligence data show, against 35% for MT4.
In Asia-Pacific, MT5 drew 1.5 million organic website visits in the third quarter, about twice the 709,700 for MT4, according to FM Intelligence's platform comparison.
