Skip to content

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

Global Financial Service Disruptions

Five unnamed Japanese FX firms (retail FX brokers)

brokerage · JP · East Asia

Confirmed cyberStatus: unknownTier 2Severity 2 of 5Evidence confidence: highAnalyst-verified

After attackers stole trading credentials from GMO Internet's VPS service used for FX auto-trading tools, Japan's FSA had FX firms alert customers, and five FX firms that reported suspected victims temporarily halted FX trading for affected customers, reset their passwords and blocked suspected overseas attacker orders. Narrow segment, so tier 2.

Original: 対象顧客のＦＸ取引を一時停止 / 攻撃者と思われる海外からの不正注文の遮断 / 対象顧客のパスワードの初期化

First disruption
unknown
First public signal
Oct 27 (Finance minister press conference)
Acknowledged
Oct 27
Restored
not yet
Duration
not established
DFX first recorded
Nov 5 14:58 UTC

What was restricted

tradingScope: multi institution

FX trading temporarily halted for customers identified as affected, their passwords reset, and suspected overseas attacker orders blocked. Broader: attacker operated trading accounts at more than 70 securities and FX firms (Euronews).

Financial impact: GMO said it would cover losses from unauthorized trading; total not disclosed

Cause, kept in separate layers

What the institution said
Unauthorized access to customer data on rental servers (GMO Internet desktop cloud VPS) used for FX auto-trading tools, followed by unauthorized FX trades
DFX classification
Confirmed cyber (cyber: confirmed)
Conflicting reports
The FX firms are not named in either source.

Dependencies

A dependency is a documented relationship. It is not evidence that the provider was compromised.

  • Provider: GMO Internet (Onamae.com Desktop Cloud) (VPS host where trading credentials were stored), verified

Evidence