GMO Internet Group’s own security unit flagged flaws in 2024 in the trading server service that hackers later breached, founder Masatoshi Kumagai said on Monday. The group also cut the pay of four executives, with Kumagai giving up 30% of monthly compensation for three months.
The service, Onamae.com Desktop Cloud, rented out Windows servers that run MetaTrader around the clock. Up to 26,739 servers may have been exposed, and brokers confirmed that hackers used stolen logins to place trades on client accounts. The service remains offline.
Kumagai told a news conference in Tokyo that subsidiary GMO Cyber Security by Ierae reported a vulnerability in April 2024, Nikkei reported. Four rounds of emergency maintenance in April and May that year did not fix the underlying problem.
Warning Did Not Reach Management
The 2024 report was not passed up to management under the group’s internal reporting rules, Kumagai said, adding that the group is discussing how to change the way information is shared.
“We were unable to put it to use in running the service,” Kumagai said of the warning, according to Nikkei and Impress Watch.
Kumagai also repeated that GMO would never pay the attackers. They had threatened to publish customer data unless GMO paid by October 27, and began posting what they said was that data after the deadline passed.
Pay Cuts Reach the Unit That Ran the Service
Tadashi Ito, deputy to the group chief executive and president of GMO Internet, the listed subsidiary that runs the service, takes a 25% cut. Hirofumi Yamashita and Kimihiro Kodama, two senior officers of the same subsidiary, take 20% each.
All four cuts start with December pay and run for three months. GMO said in its filing that the cuts reflect its current assessment and that it will reconsider how management should take responsibility once it has verified how the breach happened.
The group has already offered ¥5,000 (about $31) to every user of the service and promised to repay realized losses from unauthorized trades. It said it would publish the claims procedure by Friday, and in a stock exchange filing last Wednesday it said the total cost cannot yet be calculated.
Two Brokers Report Unrelated Disruptions
Two of the brokers whose clients were hit by the breach told customers on Monday about separate problems that neither tied to the hack.
OANDA Japan said a system failure at its partner bank, docomo SMTB Net Bank, is blocking its withdrawal instructions. Clients who asked for payouts between 11:00 on Friday and 11:00 on Monday are affected, and the bank has given no time for a fix.
Payouts due Monday will be sent again on Wednesday, without clients having to reapply. It is the second delay in less than two weeks, after OANDA held withdrawals for a day on October 22 following the GMO breach.
FXTF, which runs more than 280,000 accounts, said a setting error made its MT4 platform check client margin at 13:30 instead of the usual window between 15:30 and 15:45. The check tests whether an account holds more than 100% of the required margin. FXTF apologized and said it will review its system settings and how they are managed, but gave no count of affected accounts.
OANDA also said new accounts requested since Friday will take three to four business days to open, citing internal workload.
