Massive Trouble in Foreign Exchange Systems/Financial Systems in Japan - Hackers grabbed ~27,000 Servers - and worse . . .
October 25, 2026
There has been a massive cyberattack on Japan's GMO Internet Group. The Japanese company lost twenty-seven thousand (27,000) servers to Hackers, and that’s not even the scariest part.
GMO Internet runs a cloud service called Onamae Desktop, mostly used by forex traders running automated trading bots.
Hackers broke in, installed malware across up to 26,739 servers, stole trading credentials and started making unauthorized trades on people’s accounts!
It gets worse. This did not merely affect one broker. Over Seventy (70) different securities and forex firms across Japan and internationally have been affected. People woke up this morning to trades they never made, money moving they never authorized.
The initial investigation led to finding fraudulent trades across 70+ brokerages and FX platforms.
In an effort to block the fraudulent trades and preserve customer money, OANDA Japan has frozen customer withdrawals.
The Hackers demanded one million dollars ransom from GMO. The company refused to pay the ransom, permanently shut down the entire service, and then did something nobody expected . . .
GMO asked the Japanese government to use brand new active cyber defense powers, literally military-grade authority, that just went into effect October 1st, to trace and neutralize the attackers’ infrastructure. Under these new laws, the government can now legally hack back.
TERRIFYING TECHNICAL DETAILS
The technical details from the attacker’s own site are terrifying. GMO configured their Virtual Private Server (VPS) network using Active Directory, something you should never do on shared hosting.
Because of this, every server had admin credentials. Customers used "RDP" to connect to those servers.
An RDP File is a saved configuration file used by Microsoft Remote Desktop Connection (mstsc.exe) to connect to another computer over a network.
In those saved RDP files was the command to use "drive redirect" in the Customer's personal computer. Drive Redirect was enabled by default, meaning the moment the Customer connected to the VPS, their entire local PC was shared with the server!
So these Computer Hackers who attacked GMO, didn’t just own GMO's the servers; they had a direct path into every customer’s personal computer.
They extracted Customer data, installed backdoors into the Customer's computers. Turns out, customers were exposed like this for over 7 years but this is the first (known) time anyone exploited this vulnerability so vastly.
So about 27,000 servers were Hacked/grabbed. 70+ brokers and Financial Firms were accessed. Unauthorized trades were carried out on a massive scale, wrecking financial portfolios and losing Customer money. Customer personal computers were backdoored. And now, a company is begging its government to go to cyber war.
The scary part isn't there.
The perpetrator has secured various data from the victim's PC and is threatening the victim by saying they'll dump all the data from the PC onto the contact lists of the victim's friends and acquaintances.
The perpetrator is demanding that GMO pay 1 million dollars by noon on the 27th if they don't want that to happen.
In other words, this is an ongoing PC hostage situation. People who Trade Currencies on Foreign Exchange Markets are being driven into Bankruptcy via Fraud, and no one knows how far this will travel in worldwide Foreign Exchange markets and servers when everything opens up tonight. IF . . . . it opens.
If Foreign Currency Exchanges cannot reliably process massive numbers of ordered transactions because they may all be fraud, then Foreign Currency Exchange becomes difficult at best, impossible at worst.
This could very well escalate into a complete inability to process currency exchange worldwide for a period of time.
Theoretically, if Foreign Currencies cannot be Exchanged, international commerce cannot take place. See what that means? International Commerce stops.
