just now
OANDA Japan has implemented transaction restrictions on the accounts of customers who may have been affected by unauthorised access, following a security breach at the VPS environment of GMO Internet Group's Onamae.com Desktop Cloud service.
The broker confirmed that a third party carried out unauthorised access, unauthorised logins and unauthorised transactions in the accounts of some of its customers, using ID and password combinations that may have been leaked externally. OANDA Japan said it is contacting affected customers individually.
OANDA Japan said it has not confirmed any unauthorised access to, or information leaks from, its core systems. It believes the incident was caused by the leakage of login information stored on an external VPS server, which was then used to log in illegally.
In a further update on the same day, OANDA Japan said GMO Internet Group had formally announced a policy to compensate for damages arising from the breach, which occurred on 21 October 2026. The broker asked customers to direct compensation claims and enquiries to GMO's dedicated contact point, and said it will help customers obtain trading histories for the affected period and other data needed to submit claims.
OANDA Japan has asked customers to change their passwords for its My Page client portal and for the MT4 and MT5 trading platforms, noting that a password change disconnects all previously connected sessions, including those on the VPS. Customers have also been asked to set up two-factor authentication on MT4 and MT5, set up passkeys for My Page logins, and check their trading histories for unfamiliar trades or withdrawal requests.
The broker said it plans to strengthen its security features further, including making passkey authentication mandatory.
Found this interesting? Become a member of LiquidityFinder and get daily industry news direct to your inbox, join here.
