26,739 Trading VPS Servers Got Hacked in Japan. Here's What Every VPS User Should Check.

Imagine checking your trading account and it's just gone. Not because of a bad trade. Because the server you rented to run your trading bot got hacked.

That happened in Japan in October 2026, to customers of a Windows VPS built for forex trading. I've run a crowdsourcing platform in Japan for 22 years, so I've been running servers for a long time, and this one made me check my own setup.

I made a video when GMO published its fourth notice on October 24. Since then GMO has published twelve more. The attacker set a deadline, leaked data, and GMO put up a one million dollar bounty. This article has the whole story from the official notices, and the checks that apply to any VPS or cloud server.

I also made a video of this.

The short version

• GMO Internet's "Onamae.com Desktop Cloud" is a Windows VPS that traders rent to run MT4 and MT5 around the clock.
• On October 20, GMO found malware planted on customers' servers. On October 21 at 4:00 AM (JST) it began shutting down every server on every plan: 26,739 of them.
• Traders reported trades they never made. GMO confirmed customer information was taken out of its systems.
• The attacker demanded about 8 billion yen. GMO said it will never pay.
• GMO is paying every customer 5,000 yen, covering realized losses from unauthorized trades, and not restarting the old system.
• On October 27 the attacker published data it claims is about GMO and its customers. GMO says visitors to that site had their own information collected.
• GMO's own advice to customers goes well beyond "change your password": change it from another device, and kill every session.

What this service is

You rent a Windows machine in GMO's data center, install MT4 or MT5, and let your EA trade 24 hours a day.

That means your broker login is stored on that server. And the trading software stays logged in, all the time. That's simply how it works.

GMO's notices make the scope clear:

• Servers that could be affected: 26,739. GMO stresses this is the number that could be affected, not the number confirmed accessed.
• Information that could be affected: whatever was stored on the servers, including broker login details saved in trading tools.
• GMO does not keep customers' payment details, including card numbers, on these servers. But anything customers saved on the servers themselves is in scope.

GMO has not said how the attackers got in. Its notices say the entry point and scope are still being investigated with an outside security firm.

The timeline, from all 16 notices

Times are Japan time.

Date	What happened
October 19	Customer inquiries. GMO starts investigating
October 20	Malware found on some customers' servers. New sign-ups and the control panel are stopped
October 21, 4:00	Every server on every plan is shut down, one by one. First notice. An extortion email arrives demanding about 8 billion yen
October 21 onward	Customers report trades they didn't make
October 22, 13:00	GMO goes to the police. Second notice asks customers to change passwords and log off
October 23	Third notice: a changed password may not end an existing broker session
October 24	Fourth notice: customer data confirmed taken out. Payments to customers. Request to the government for Active Cyber Defense. Fifth notice: scan your own PCs
October 25	GMO asks customers to lend their PCs for investigation. Staff travel across Japan to collect them
October 26	Sixth and seventh notices. GMO says the attacker has announced a data release and a ransomware attack for October 27 at 12:00
October 27, before 12:00	GMO asks customers to back up, disconnect and power off their PCs, and unplug every cable
October 27, 12:30	GMO confirms the attacker has published data it claims is about GMO and its customers
October 27, evening	Special payments for customers whose data is published. A bounty of up to 1 million US dollars
October 28, around 4:00	The domain of the attacker's site is taken down
October 29	GMO's own team hands information it thinks can identify the attacker to the police
October 30	GMO starts contacting customers about the 5,000 yen payment and the replacement service

Over the same days, GMO's PC investigations found no malware or ransomware on the machines analyzed so far, and no ransomware attack had been confirmed as of October 27, 13:55.

The losses

Japanese media reported one trader who lost about four million yen in two seconds, and another whose account of about 4.3 million yen was almost wiped out. On X, people posted losses of 550,000 yen and six million yen.

The attacker's threats, as listed in GMO's fourth notice, went past the trading accounts:

• Keep placing unauthorized orders on customers' accounts at more than 70 brokers and FX firms, in Japan and overseas
• Publish information about the service and about customers' PCs that connected to it, and carry out ransomware attacks
• Publish information about GMO's systems and operations

That second line is why GMO later asked customers to scan, back up and power off their own PCs.

What GMO is paying

GMO's position: it will not pay the attacker, because paying guarantees neither deletion nor non-use of the data, and would fund more attacks. Instead it is paying customers.

Payment	Details
Apology payment	5,000 yen to every current customer, whether or not they lost money
Unauthorized trades	Realized losses (the trading loss plus fees) from trades GMO confirms were caused by this access. Market moves, lost profits and indirect damage are not covered
Order of payment	Customers first ask their broker to cancel or refund. GMO pays what the broker doesn't. If the broker refuses, GMO pays the covered loss
How GMO checks	Trading and access records. It may ask for an ID document and a read-only investor password for MT4 or MT5, and says it will never ask for any other password
Published data	Per category of data confirmed published: 10,000 yen for basic details like name and contact, 15,000 yen for account IDs and passwords, 25,000 yen for sensitive information. Up to 3 million yen per publication
Ransomware victims	A new PC of the same spec as the damaged one
Replacement service	A Windows desktop on a separate cloud platform, free for 6 months. No one is moved without consent

The old system is not coming back. GMO decided to rebuild its security architecture rather than restart what was breached.

The leak and the bounty

On October 27, GMO confirmed the attacker had published data. GMO's warnings about it are worth repeating for anyone, anywhere:

• Don't visit the site. GMO says visitors' own information was collected by the attacker. If you already visited, run a full antivirus scan.
• Don't repost it. GMO is preparing legal action against malicious spreaders.
• Some of what was published may not be true.

The next morning, around 4:00 Japan time, the site's domain was taken down.

GMO then launched a cybercrime bounty, with rewards of up to 1 million US dollars (about 150 million yen) for information leading to the attacker. Tips came in fast:

Time (JST)	Tips, cumulative
October 28, 18:00	113
October 29, 18:00	321
October 30, 18:00	428
November 2, 18:00	735

On October 29, GMO said its own team had found information it believes can help identify the attacker, and handed it to the police.

Japan's Active Cyber Defense

Japan has a new law that took effect on October 1. It lets the government go after the servers attackers are using, and actually neutralize them. It's called Active Cyber Defense.

On October 24, GMO asked the government to treat this case as the very first use of it. In its words, this was not just one company's outage: the attack targeted ordinary people's financial accounts, and a private company alone can't track down criminals working across borders.

The real lesson: kill every session

If the place where your passwords live gets breached, you lose everything.

On a trading VPS, the software is already logged in to your broker. The attacker doesn't need to crack anything. They just place orders.

And GMO's third notice adds the part most people miss. Even after you change your password, depending on the broker's servers, an existing session can stay alive for a while, and someone can keep trading.

Here is GMO's full list for affected customers, combined from notices 2 to 6. It works for any breach where a machine you log in from may be compromised.

• Change passwords from a device you don't use for trading, like your phone or another PC. Never from the breached server.
• Log out of every device and every session. If your broker has no button for it, ask the broker to cut all sessions. Do it even if you already changed the password.
• Change passwords for your broker, email, Google and anything else. Change any password that was saved in a browser on the server, and any password you reuse elsewhere.
• Turn on two factor authentication wherever it's offered.
• Remove linked apps, mail forwarding rules, browser extensions and registered devices you don't recognize.
• Keep browser sync off until you've finished checking.
• Run a full scan, not a quick scan, on every PC and phone that connected to the server.
• Back up important files to an external drive while disconnected from the network.
• Go to services through their official sites, not links in emails or texts. GMO will never ask for your password or a verification code.

What every VPS user should check today

Even if you never touched this service, if you use any VPS or cloud server, check these.

1. Don't store other passwords on the server. Saved browser passwords, FTP clients, email apps, trading tools. If the server is breached, all of it gets read. GMO's notices list exactly these: browser saved passwords and credentials stored on the server.

2. Turn on two factor authentication on every account that can move money. A stolen password alone shouldn't be enough.

3. Lock down the way in. Don't leave Remote Desktop or SSH open to the whole internet. Limit it to your own IP, or put it behind a VPN. And block repeated failed logins automatically. On the servers I run, that's non-negotiable.

4. Find your "log out everywhere" switch before you need it. Check now whether your broker, bank and email let you end all sessions, and where. If it's a phone call, save the number somewhere that isn't the server.

5. Know which clean device you would use. GMO's first instruction was to change passwords from a device you don't trade on. Decide now which one that is.

If you run a service yourself

Within four days of finding this, GMO said: we won't pay the attacker, we'll cover your losses, and we'll rebuild everything. Then it kept talking: 16 notices between October 21 and 29, a phone line open 24 hours, a dated timeline in every notice, and a repeated line that it will never ask for a password.

Customer trust isn't about whether something goes wrong. It's about what you do after it does.

Not sure if your own server is set up safely? Leave a comment on the video with your host and what you run on it. I read every one.

Sources: GMO Internet Group's notices on the Onamae.com Desktop Cloud incident, second to sixteenth (October 22 to 29, 2026, the sixteenth updated November 2), its October 30 notice on payments and the replacement service, and the Onamae.com first notice (October 21); ASCII.jp English edition (October 21). Loss figures for individual traders are from Japanese media reports (Kyodo News, Yomiuri Shimbun, ITmedia NEWS) and posts on X, as cited in the video, and were not checked against the traders' own records. Read November 2, 2026.