OANDA Japan confirmed on 26 October 2026 that third parties had accessed and traded in some customers’ accounts using combinations of IDs and passwords potentially leaked outside the broker. It said it had restricted potentially affected accounts to limit further damage and was contacting customers individually.[3]
The incident concerns Onamae.com Desktop Cloud, a third-party VPS environment used to run trading software including MetaTrader. OANDA’s latest notice says it has not, at this stage, confirmed unauthorised access to or information leakage from its own core systems. That statement does not negate the confirmed misuse of customer credentials.[3]
The published sequence
| Date, Japan time | Notice and action |
|---|---|
| 22 October | OANDA warns of possible credential exposure linked to the external VPS service and asks customers to reset passwords and review activity. |
| 22–23 October | OANDA adds withdrawal verification and publishes a revised processing timetable. |
| 24 October, 11:50 | GMO confirms unauthorised access and data exfiltration, announces compensation and plans an alternative cloud service. |
| 24 October, 15:00 | GMO asks users to disconnect all trading sessions as well as changing passwords. |
| 26 October | OANDA confirms unauthorised access and trades in some accounts and imposes targeted restrictions. |
What GMO’s compensation announcement covers
Separate payments and conditions
| Measure | Published terms |
|---|---|
| ¥5,000 payment | For all current users of the affected service, regardless of financial loss; separate from loss compensation. |
| Trading-loss compensation | Realised trading losses and fees that GMO determines resulted from unauthorised transactions caused by the incident. |
| Exclusions | Ordinary market losses, profits that might have been earned and other indirect losses. |
| Other refunds | Amounts refunded by the trading provider are deducted to avoid duplicate compensation. |
| Communication deadline | GMO says payment and alternative-service instructions will be emailed by 30 October at 23:59 JST. |
GMO said it would not restart the compromised system unchanged. It plans to offer an alternative service on an independent cloud infrastructure, with six months free after migration and prior disclosure of differences and later charges. Migration requires the customer’s consent.[4]
Password changes and active sessions are separate
GMO’s fifth notice warns that some broker servers can preserve existing sessions after a password reset. It therefore asks customers to disconnect every active session, including through their broker where necessary, even if passwords have already been changed. It also advises using a device not used for FX trading for the reset, enabling available two-factor authentication, checking balances and histories, and reporting unfamiliar trades to the trading provider.[5]
OANDA’s earlier withdrawal notice moved requests received by 11:00 JST on 22 October to processing after 11:00 on 23 October, targeting completion by 16:00. Requests received by 11:00 on 23 October were also targeted for processing that day. Those were dated processing targets, not proof that every recipient bank credited funds at the stated time or that all subsequent restrictions have ended.[2]
Sources & further reading
- Notice of potential unauthorised logins after Onamae.com Desktop Cloud incident OANDA Securities Japan · 22 Oct 2026 · Accessed 26 Oct 2026
- Temporary changes to withdrawal processing schedule for enhanced security OANDA Securities Japan · 22 Oct 2026 · Accessed 26 Oct 2026
- OANDA Japan second notice: unauthorised logins and trades following external VPS breach OANDA Securities Japan · 26 Oct 2026
- Onamae.com Desktop Cloud cyberattack: fourth notice, payments and compensation GMO Internet · 24 Oct 2026 · Accessed 26 Oct 2026
- Onamae.com Desktop Cloud: fifth notice and session-security precautions GMO Internet · 24 Oct 2026 · Accessed 26 Oct 2026