GMO Is Asking Japan's Government to Hack the Hackers Who Broke Into Its FX Trading Servers and Demanded Ransom

Attackers broke into the servers Japanese retail traders use to run their FX bots around the clock, stole the trading logins stored there, placed trades in customers' brokerage accounts and then demanded money. GMO Internet refused to pay. Instead it has asked Tokyo to hack the hackers.

GMO wants its case to be the first ever use of Japan's new active cyber defense law, which lets the state break into attackers' servers. The government is hedging.

What was hit

The target was Onamae.com Desktop Cloud, a service launched in 2010 that rents Windows virtual private servers so individual investors can run trading programs 24 hours a day with the accounts they hold at securities and FX firms. It has more than 20,000 users. Up to 26,739 servers may have been affected, and login information may have been stolen.

GMO began investigating on October 19 after a customer inquiry. The next day it confirmed a third party had installed an unauthorized program in some customers' server environments, and from 4 a.m. on October 21 it shut down the servers of every plan. Since then customers have reported trades in their accounts that they never made. In its notice, GMO admits the service had security vulnerabilities and that customer information was taken out. It consulted police on October 22. Japanese brokerage accounts have been hit this way before, as when hackers placed trades in Iwai Cosmo customer accounts.

The ransom threat

The attacker's demand came with a list of threats. Refuse, and it would keep manipulating customers' trading accounts at more than 70 securities and FX companies in Japan and overseas, publish information about the service and the customer PCs connected to it, run ransomware attacks, and leak details of GMO's own systems.

GMO said no, arguing that paying would not guarantee the data is deleted, and handed evidence to police cybercrime units. It also asked major exchanges and brokers to block access coming from the service and force disconnect its sessions.

Every current user gets a flat 5,000 yen goodwill payment regardless of losses, plus compensation for realized losses from unauthorized trades, minus any broker refund. GMO will pay even where a broker refuses. Market swings and lost profits are not covered, and application details arrive by November 6. The service will not restart on the breached infrastructure; users get a replacement on separate cloud infrastructure, free for six months. GMO says it cannot yet calculate the financial impact.

Asking the state to strike back

Japan began operating active cyber defense on October 1. The law lets police and the Self-Defense Forces pre-emptively break into an attacker's servers to neutralize them.

In its group filing, GMO asks for the "first case of activation." It calls the attack "an extremely malicious and unprecedented method" because it goes beyond encryption and data theft to manipulating and destroying ordinary citizens' trading accounts. A private company alone, GMO argues, cannot eradicate sophisticated cross-border criminal groups.

Tokyo does not sound eager. According to Japanese press reports, the government has taken a cautious stance, saying the system is not activated at the request of individual companies.

GMO has not named the attacker or explained how it got in.

Some offers on this page may be paid placements or contain affiliate links.