The hardest story in cybersecurity news today is not about a flaw in a trading app. It is about where traders keep their keys. GMO Internet Group has confirmed that attackers breached Onamae.com Desktop Cloud, its VPS and remote-desktop service, and reached customer server environments where FX traders run MetaTrader 4/5 bots around the clock with brokerage credentials and live sessions stored on the servers. The attackers used stolen trading credentials to place unauthorized trades in customer accounts at more than 70 securities and FX firms, then demanded $50 million. Up to 26,739 servers were potentially affected (GMO Internet Group incident reports; AP reporting). This page states what GMO has confirmed, then gives you a working audit: six questions about your own hosted automation, scored against the exact pattern this incident ran on.
Put the shape in proportion. The brokers were not the weak point, and neither was any password policy. The weak point was a rented machine that never sleeps, holding saved logins and live sessions for accounts that move real money. Whoever holds that machine, or breaks into it, holds the sessions. The audit below scores how much of that shape your own setup has.
Hosted automation is now a standard target shape, and this incident is the clearest demonstration of why. A trading bot on a VPS concentrates three things an attacker wants in one place: credentials at rest, sessions that stay signed in, and a machine that is online and unattended around the clock. The GMO attackers did not need a flaw in MetaTrader or in any broker. They needed the environment the bots live in. Every agent, bot, and automation runner on rented infrastructure has the same concentration in some degree. The question the audit answers is how much of it yours has, and which piece to fix first.
The second lesson is in the admission. GMO's CEO has said the company's own security specialists found the issues before the attackers did, and the response was insufficient. Known weaknesses that stay open are the exposure; the audit below is built to surface yours while they are still cheap to close, and to order the fixes the way GMO now orders them for its own customers: credentials first, sessions second, history review third, key scope and two-factor authentication after.
Answer six questions about the server your bots or agents run on. Everything runs in your browser; nothing is sent anywhere. The verdict shows its reasoning for every answer and lists the fix for each weak one, in the order GMO's own guidance uses.
Agent Auth Gateway, Ingenious AI's gateway for application and agent identities, exists for the shape this incident exposed: credentials and live sessions acting with an account's full authority, from a machine nobody is watching. It puts identities behind allowlists, budgets, and a kill switch, so a stolen login or a hijacked session meets a limit and a stop button instead of an open account. See Agent Auth Gateway.
One vendor, one security posture. Every platform below is live now on getingeniousai.com.
Onamae.com Desktop Cloud is GMO Internet Group's VPS and remote-desktop service, used heavily by FX traders who run MetaTrader 4/5 bots around the clock. GMO began investigating after a customer inquiry on October 19, 2026, confirmed a malicious program inside some customer server environments on October 20, and began shutting down all servers on October 21. Its October 24 report confirmed a security flaw in GMO's own platform, unauthorized access to the service environment, and customer information taken out. Up to 26,739 servers were potentially affected.
Session abuse is acting through a login session that is already signed in, instead of signing in yourself. The compromised servers held brokerage credentials and live signed-in sessions for the trading platforms the bots run. With those, the attackers placed unauthorized trades in customer accounts at more than 70 securities and FX firms in Japan and overseas. One account reportedly lost about 2.4 million yen in about 84 seconds of repeated trades.
A demand note dated October 21 demanded $50 million in Bitcoin or Ether, threatening more unauthorized orders, publication of stolen service and customer-PC information, and ransomware attacks. GMO refused to pay, gave the evidence to police cybercrime units, engaged about 200 security staff, asked major brokers and exchanges to block access coming through the service and force-disconnect active sessions, and requested government assistance. GMO pledged a 5,000 yen goodwill payment to all current users of the service and compensation for verified fraudulent trading losses.
Follow the order in GMO's own guidance to its customers. Change trading-account and trading-tool credentials immediately, using a device that was not used for trading on the compromised service. Disconnect any active sessions. Review transaction histories and balances for activity you do not recognize. Scope any API keys to trading only, with withdrawals off and an IP allowlist set. Enable two-factor authentication on the broker accounts and on the server's own sign-in. Write the kill plan down before you need it: the broker-side session revoke steps and the credential rotation, in order.
Sources: GMO Internet Group incident reports, October 2026 (the October 19 customer inquiry and investigation start, the October 20 confirmation of a malicious program in customer server environments, the October 21 server shutdowns, and the October 24 confirmation of a flaw in GMO's own platform, unauthorized access, and customer information taken out; the 26,739 potentially affected servers; the more than 70 securities and FX firms; the $50 million demand note dated October 21 and GMO's refusal; the police referral, the roughly 200 security staff, and the broker session-disconnection requests; CEO Masatoshi Kumagai's admission that internal security specialists had identified issues earlier and the response was insufficient; the 5,000 yen goodwill payment and compensation for verified fraudulent trading losses; and GMO's guidance to customers on credential changes from a clean device, session disconnection, history review, and two-factor authentication), as read through Japan Cyber Watch's coverage of those reports and AP reporting carried by Euronews (including the near-16-percent share fall), with the 2.4 million yen, 84-second account loss as reported by CryptoNews and the demand-note detail as reported by TradingKey.