GMO Founder Reveals Internal Security Warning Prior to MetaTrader Server Hack

GMO Internet Group founder Masatoshi Kumagai revealed that the company's dedicated security unit identified system vulnerabilities as early as 2024 within the trading server infrastructure that was eventually compromised by hackers. The admission came during a recent press conference in Tokyo, shedding light on the timeline of the high-profile breach affecting the Onamae.com Desktop Cloud service.

The compromised service is widely utilized by retail forex participants for renting out Windows servers capable of running MetaTrader platforms around the clock. According to reports, as many as 26,739 servers may have been exposed during the incident, prompting major brokers to confirm that malicious actors successfully utilized stolen credentials to execute unauthorized trades on client accounts.

In response to the severe security failure, GMO leadership took immediate disciplinary action by cutting the pay of four key executives. Founder Masatoshi Kumagai personally stepped forward to forfeit 30 percent of his monthly compensation for a period of three months to assume accountability for the oversight.

Investigations revealed that the group's subsidiary, GMO Cyber Security by Ierae, had specifically reported a critical vulnerability back in April 2024. Despite conducting four separate rounds of emergency maintenance across April and May of that year, the underlying architectural problem was never fully resolved, leaving the door open for the subsequent cyberattack.

Following the breach, the affected desktop cloud service was taken entirely offline to prevent further damage and secure remaining client data. The prolonged outage has caused significant operational disruption for traders and brokers who relied on the infrastructure for automated strategy execution and continuous algorithmic trading.

Industry analysts point out that this incident highlights broader vulnerabilities in third-party hosting and cloud infrastructure used across the forex trading sector. As prop firms and retail brokers increasingly rely on virtual private servers for automated trading, robust cybersecurity protocols remain paramount to protect sensitive user credentials.

PropFXLab will continue to monitor updates regarding the server hack, broker liability, and any permanent remediation steps taken by GMO. Traders utilizing external cloud environments are advised to review their account security settings and employ two-factor authentication wherever possible.