Hackers Publish Alleged GMO Customer Data as Broker FXTF Shuts Out Overseas Logins

Hackers behind the breach at GMO Internet Group's trading server service published what they claim is customer information on Tuesday after GMO refused to pay a ransom of about ¥8 billion (approximately $50 million). The material appeared online at around 12:30 local time, half an hour after the attacker's deadline, GMO said in a statement.

The cyberattack has affected multiple Japanese forex brokers, with FXTF taking the unusual step of blocking all login attempts from outside Japan. The broker, which operates more than 280,000 accounts from Tokyo, cited efforts to maintain "a safe and secure trading environment" as the reason for the drastic measure.

GMO had previously instructed users to back up files, disconnect their PCs, and unplug them before noon on Tuesday. As of 13:55 local time, the company had not confirmed a ransomware attack, though it acknowledged that up to 26,739 servers may have been exposed in the incident.

Brokers Respond to Security Breach

Five Japanese FX firms have reported affected customers, according to Finance Minister Satsuki Katayama. The brokers that found unauthorized trades have taken various actions: OANDA Japan restricted trading on affected accounts and plans to make passkeys compulsory; Gaitame Finest restricted accounts and slowed withdrawals for extra checks; and Dukascopy Japan said restrictions were under consideration.

FXTF went further by blocking all overseas IP addresses from accessing its MT4, MT5, and FXTF GX platforms. The broker also indicated it may suspend trading on accounts that could have been reached through the GMO service and implement one-time passwords for additional security.

Government Response and Industry Impact

Prime Minister Sanae Takaichi has directed her cabinet to draft emergency measures against cyberattacks by the end of next week, according to Bloomberg. The incident comes amid growing concerns about cybersecurity in Japan's financial sector, with GMO shares falling the most since 2011 following the breach.

Account takeovers were already a policy issue in Japan, with fraudulent trades on hijacked accounts exceeding ¥500 billion across nearly 6,000 incidents between March and May 2025, according to the Financial Services Agency (FSA). Despite the recent breach, Marito Ueda, president of SBI FX Trade, noted that active FX traders have remained in the market, as trading volumes have not declined.

MetaQuotes, which develops MT4 and MT5, clarified that neither the platforms nor the trading servers had been compromised. Instead, it blamed breaches at third-party hosting providers, possibly through unpatched management systems, with PHP-based ones being "particularly vulnerable."

Customer Data and Compensation

GMO stated it has not verified the published material, some of which may be inaccurate, and will contact customers whose data it confirms. The company is considering additional payments for customers whose data is confirmed published, on top of the ¥5,000 it already pledged to every user.

GMO emphasized that paying the attacker would not guarantee the data would be deleted, citing the case of ION, which faced a similar choice in 2023 after a LockBit attack. The company is preparing legal action against individuals who spread the leaked data and has asked the public not to visit the sites where it was published, as visitors' own information could be compromised.

GMO and its partners have collected PCs from customers across Japan for analysis. While none examined by late morning showed malware, the company noted this did not prove every device was safe. The broker plans to publish how customers can claim compensation for realized trading losses by November 6.