Japanese internet group GMO Internet has moved to compensate customers after intruders broke into its Onamae.com Desktop Cloud service and planted malicious software on customer servers, in an incident that has since spilled over into unauthorised foreign-exchange trading.

The company confirmed the intrusion on 20 October 2026 and began shutting down customer servers progressively from 04:00 local time on 21 October. It put the number of servers potentially affected at 26,739. Desktop Cloud is a hosted Windows desktop service widely used to run automated trading software around the clock, including MetaTrader 4 and MetaTrader 5.

Trading accounts hit through exposed credentials

Brokers have since confirmed unauthorised trades on some customer accounts. OANDA Securities said on 26 October that third parties had accessed some accounts and placed trades using login details that may have been exposed through an external server service, while limiting trading on potentially affected accounts. It said it had not established that its own core systems were accessed.

GMO has warned customers who stored passwords or other secrets on their servers to change them from a different device, and to watch for phishing messages exploiting the incident. Payment card details were held on separate infrastructure and were not affected, the company said.

Compensation and a replacement service

On 24 October, GMO said it would pay 5,000 yen to every current Desktop Cloud user, whether or not they suffered a financial loss, and would cover verified realised losses and fees from unauthorised trades caused by the incident. Customers who still want a Windows desktop will be offered a replacement on an independent cloud platform, free for six months. GMO says it has handed threat messages to police.