GMO shuts FX hosting after intrusion, interrupting trading robots across its service

GMO Internet began shutting Onamae.com Desktop Cloud servers from 04:00 Japan time on 21 October after detecting malicious software the previous day. The suspension covered all plans, with no restart time specified.[1]

It identified 26,739 potentially affected server instances, with possible viewing of stored information. This is a server count, not a trader count. Leakage of customer personal information and misuse of viewed data remained unconfirmed.[1]

The trading connection is direct: Desktop Cloud is marketed as a virtual private server for running MetaTrader 4 or MetaTrader 5 and automated strategies. Its purpose is to keep trading software operating without a home computer staying on. Suspending the hosting environment therefore interrupts the customer-side machinery used to monitor prices and generate instructions.[2]

What stops with the terminal

The service boundary matters for open positions. MetaQuotes documents that an MT4 trailing stop runs in the client terminal. If that terminal stops, it stops adjusting the protective level; a stop-loss level already placed on the broker’s server remains there. The same documentation distinguishes server-side stop-loss and take-profit instructions from the terminal’s trailing logic.[6]

That distinction gives a precise way to describe the interruption. A hosted terminal can stop updating a strategy without cancelling every instruction already accepted by a broker. Customers need to distinguish server-held orders from rules that depend on the suspended computer continuing to run. The state of an account depends on which instructions its broker had already accepted.[6]

GMO asked customers to change credentials stored or used on the servers, including reused passwords elsewhere, and to watch for impersonation. Restoring connectivity alone would not address the potential exposure of those credentials.[1]

Published credits are conditional, and incident treatment is pending

The current product homepage directs customers to the service-level agreement and says the treatment of this incident will be announced once decided. It also indicates that new VPS applications are suspended. An advertised availability commitment should therefore be read alongside the incident-specific decision, rather than as an already approved refund.[2]

For an eligible October interruption, the ordinary application rule points to 30 November. The exclusions make it premature to apply either percentage automatically to this cyber incident. They also make records of the actual interruption relevant to any claim under the published process.[3]

Reopening the server and recovering a strategy are separate jobs

The backup guidance says the servers use RAID disk redundancy, but customer data is not guaranteed and customers should maintain their own regular backups. Redundant disks address a hardware-failure problem; they are not a substitute for an independently retained copy of a trading configuration.[4]

A separate help page says the provider does not undertake recovery of data inside a customer’s virtual machine. The published membership terms describe Desktop Cloud as a hosted desktop service centred on FX automation and contain a liability exclusion for connection failures and related consequences, subject to the service-level guarantee where applicable. Those provisions describe the standard service framework; they do not settle liability for this incident.[5][7]

For users of automated strategies, operational recovery consequently has more than one component: a usable hosting environment, trusted credentials and a known strategy configuration. The provider said it would announce the restart time once determined.[1]

Report an error or submit an update