A hacker group has demanded $1 million, about ¥150 million, from GMO Internet Group after breaching the servers behind its foreign exchange trading service, Tokyo Reporter reported. The attackers set a deadline of noon on Tuesday, Oct 27, 2026.
GMO confirmed that unauthorized and fraudulent transactions had already gone through on the FX margin trading platform. In response, the company told users to physically unplug their computers and cut the power, an instruction aimed at severing any connection the attackers might still hold.
The demand was posted on the attackers' own website, which carried the ultimatum and the payout figure. GMO's warning to clients went out ahead of that deadline.
White hats brought in to check user machines
A team of white hat hackers — security specialists who probe systems with the owner's permission — has been deployed to investigate the breach. The team is examining the physical devices of affected users to establish whether malware has been planted on them.
That work matters because a compromised terminal can hand an attacker a route back into the network even after the servers themselves are secured. GMO has not said how many users are affected or how large the fraudulent transactions were.
FX margin trading lets retail investors bet on currency moves with borrowed funds, and the platforms that run it hold account and login data for large numbers of individual customers. A breach at a brokerage of GMO's size puts those credentials and any linked funds at risk.
What customers were told to do
The instruction to unplug and power down is unusual in its bluntness. Most breach notices ask customers to change passwords or watch for suspicious activity; GMO asked them to take their machines off the network entirely.
Users who have not yet done so should disconnect from the internet and leave the device off until the company says otherwise. GMO has not indicated when normal service will resume.
The company has not commented publicly on whether it intends to pay. Ransom demands of this kind are typically accompanied by threats to publish stolen data or to keep systems offline, though the attackers' site as described carried only the payment demand and the deadline.
Japanese financial regulators have pressed brokerages in recent years to tighten controls over outsourced systems and customer data, and a confirmed fraudulent transaction on a live trading platform will draw scrutiny of how the FX servers were secured.