Japan: OANDA confirms unauthorized trades after VPS host breach

On Monday, October 26, 2026, OANDA Japan (OANDA証券) confirmed unauthorized logins and trades on some client accounts, according to FX News Group, Finance Magnates and TokenPost. A third party used username and password combinations that may have leaked from an external provider, GMO Internet's “Onamae.com Desktop Cloud” virtual private server (VPS) service. The broker restricted trading on accounts that may have been affected. It has not disclosed the number of accounts or orders involved, nor the size of the losses.

OANDA Japan says there is no indication so far of unauthorized access to its core systems or of a data leak from them, and attributes the incident to credentials stored on an external VPS. The same day, it asked clients to change the passwords for their “My Page” client area and their MT4 and MT5 platforms, to enable two-factor authentication on MT4/MT5 and to review their transaction history. It also recommends using a passkey to log in to My Page.

MetaTrader credentials exposed at a hosting provider

Onamae.com Desktop Cloud is used to run MetaTrader 4 and 5 and automated trading programs (EAs) around the clock. Credentials saved on these servers give access to accounts held with other brokers.

According to GMO's timeline, the host opened an investigation on October 19 after user enquiries, found malicious software on October 20, and announced the gradual shutdown of all its plans in a first statement issued on October 21 at 4 a.m. Japan time. GMO said up to 26,739 servers may have been affected, a figure that represents neither confirmed intrusions nor affected accounts. In its fourth statement, dated October 24 Japan time, the company said it had found a security flaw in the service's system, confirmed the unauthorized access and established that customer information had left the company.

OANDA Japan's messaging shifted within a few days. Its first notice, dated October 22, 2026, only said that the credentials of clients using its MT4/MT5 on the service may have been viewed by a third party; it mentioned no fraudulent orders and said next steps were under discussion. The same day, OANDA Japan announced a temporary change to its withdrawal schedule, citing stronger security, while Finance Magnates reported that the broker was holding withdrawals.

GMO Internet pledges to cover realized losses

GMO will reimburse realized losses and fees tied to orders it recognizes as fraudulent. Losses from market moves, missed gains and indirect damages are excluded, and clients must provide evidence of the harm. On top of that, the host will pay 5,000 yen (about 32 dollars) to every current customer of the service, whether or not they suffered a loss. It is also offering a replacement server on separate infrastructure, free for six months.

GMO has asked major exchanges and securities firms to block access coming from the service and to terminate all active sessions. It warns that a session that is already open may stay active after a password change, which in some cases lets a third party keep trading. The company also says it will not give in to the demands of the person presented as the attacker.

On the regulatory side, Japan's Financial Services Agency (FSA) on Thursday, October 22 asked FX firms to urge clients to change their passwords and to monitor suspicious orders, according to Nikkei and the Asahi newspaper. The notice was sent through the Financial Futures Association of Japan, the industry's self-regulatory body.

Five brokers affected, by Finance Magnates' count

By Finance Magnates' count, five brokers licensed in Japan have now reported fraudulent orders, including OANDA Japan, AvaTrade Japan, Gaitame Finest and FXTF. Not every outlet uses that total: TokenPost lists only AvaTrade Japan and Gaitame Finest as confirmed cases before OANDA. None of these brokers has put a figure on the accounts involved.

• AvaTrade Japan confirmed on October 23 unauthorized orders on accounts of clients who used GMO's service.
• Gaitame Finest confirmed on October 21 fraudulent logins and orders on some accounts, then restricted their use. Its notice refers to credentials that may have leaked from other companies' services without naming Onamae.com, so the link to the GMO incident has not been formally established.
• FXTF (Goldenway Japan) announced on October 22 that some clients' credentials had been obtained fraudulently through an external VPS and that unauthorized logins or orders may have occurred. Under a notice dated October 23, it now requires a one-time password (OTP) to log in to MT4/MT5, and it is restricting access from abroad.

Offshore brokers including Titan FX and Axiory have issued warnings to clients without reporting confirmed fraudulent orders.

What it means for traders

The most exposed would be traders who ran MT4, MT5 or EAs on Onamae.com Desktop Cloud with their broker credentials saved on the server. Because those credentials work for accounts held elsewhere, the risk would not be limited to the five brokers named.

The password change requested by OANDA Japan and the FSA may not be enough: based on GMO's warning, a third party could keep control as long as active sessions have not been terminated. Affected clients would have an interest in confirming with their broker that sessions have been cut, and in changing the client-area password and each trading account password separately. The OTP now required by FXTF would strengthen protection but raises a practical question for automated trading: how an unattended EA reconnects when a code is required would still need to be clarified with each broker.

Getting reimbursed would depend on proving the harm. Exporting and keeping order histories and account statements would therefore be useful, especially as only realized losses and fees tied to orders recognized as fraudulent would be covered. The account restrictions and the change to the withdrawal schedule at OANDA Japan also show that access to funds could slow down during checks.

Beyond Japan, the episode highlights a concentration risk specific to third-party VPS services: a single compromised host can expose accounts held with several brokers. Avoiding saved credentials on such servers, and preferring the broker's own VPS or read-only access (investor password) where possible, would reduce that exposure.