GMO Internet said it will compensate users for realized losses caused by unauthorized trades after its "Onamae.com Desktop Cloud" service was compromised. In its fourth notice, released at 11:50 a.m. Japan time on Oct. 24, the company said all current users will also receive a 5,000 yen consolation payment. GMO confirmed it had received a monetary demand from the attacker and said it would not comply.
Cloud service used for automated FX trading may have exposed 26,739 servers
The service rents out Windows-based cloud machines and is commonly used to run high-speed automated trading strategies for foreign exchange. GMO said the platform has more than 20,000 users and that 26,739 servers may have been affected. All plans had been taken offline in stages starting at 4 a.m. on Oct. 21.
In a later update, GMO said trading tools stored on the machines, including MT4 and MT5, as well as broker account passwords, may have been viewed by a third party. That means the attacker may have obtained login credentials capable of placing orders directly.
User says account lost more than 4 million yen in about two seconds
According to an interview published by The Asahi Shimbun, a 44-year-old office worker in Kanagawa Prefecture said he was watching his trading screen at 4:22 p.m. Japan time on Oct. 21 when his account lost more than 4 million yen in roughly two seconds, or about TWD 830,000. A caption attached to the report’s image put the figure at about 4.15 million yen. Suspicious trades then continued for nearly two minutes, pushing the total loss beyond 6 million yen, or about TWD 1.25 million.
The man said he normally uses automated trading, but the orders did not match the conditions he had set. Afterward, he received an email in Japanese from someone identifying as "Hacking Team," saying, "We have destroyed the entire balance in the account."
Another reported victim, a 29-year-old office worker in Aichi Prefecture, found early on Oct. 22 that more than 4.3 million yen in her account had been almost entirely wiped out, leaving just 6,768 yen.
Victim says losses came mainly from fees on oversized trades
A victim interviewed by TV Asahi described how the losses were generated. The attacker used his account to buy an abnormal amount of 5 million units of U.S. dollars and then sold the position seconds later. Because the exchange rate barely moved, most of the loss came from transaction fees.
The victim said the position was closed within one second, which in his view pointed to a deliberate attempt to burn funds through fees. A ransom note shown by TV Asahi said, "Because GMO refused to negotiate, we destroyed the entire balance."
Attacker threatened more trades across 70-plus brokerages
In its fourth notice, GMO said the attacker demanded payment and threatened to continue placing improper orders through customer accounts held at more than 70 domestic and overseas securities and foreign exchange firms if the company refused. The attacker also threatened to publish data from users’ computers and launch ransomware attacks.
GMO said it would not pay because payment would not guarantee deletion of the data. The company added that all communication records had been handed over to the police cybercrime unit.
There is still no official total for the damage. TV Asahi reported that GMO said there was "no figure that can be confirmed" and that details were still under investigation. The Yomiuri Shimbun separately reported that a hacker group had posted an online statement claiming it caused losses of tens of billions of yen, though that claim came only from the attacker’s side.
Compensation limited to realized losses from unauthorized trades
Under the compensation framework announced so far, GMO said it will cover realized losses from unauthorized trades that it determines were caused by the intrusion, including trading losses and fees.
Losses caused by market fluctuations, profits that users might otherwise have earned, and other indirect damages are excluded. Users must first contact their brokerages to request trade cancellations or refunds. Any amount already returned by a brokerage will be deducted from GMO’s payment. If a brokerage does not refund the user, GMO said it will pay the amount itself. The application process will be announced by Nov. 6.
5,000 yen payment for all current users
GMO said every current user, regardless of whether they suffered losses, will receive a separate 5,000 yen consolation payment, or about TWD 1,040. The company said instructions for receiving that payment will be sent by email by Oct. 30.