Hackers Publish Alleged GMO Customer Data as Broker FXTF Shuts Out Overseas Logins

Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.

If you run an expert advisor on MT4 or MT5 from a rented virtual private server, the story that broke out of Tokyo this week is not really a broker story. It is a story about where your trading credentials live. Hackers behind the breach at GMO Internet Group's trading server service published what they claim is customer information on Tuesday, after GMO refused to pay. FXTF, one of the Japanese brokers whose clients had trades placed without consent, responded by blocking every login from outside Japan.

That places this squarely in the expert advisor (MT4/MT5) sub-niche of automated trading, and more specifically in the VPS and hosting layer that most EA users never think about until it fails. During our 2026 review cycle we benchmarked the Ellington AI trading platform against a basket of MT4 and MT5 dependent setups, and the 11 broker notices reviewed since October 21 map almost exactly onto the failure modes we flag in that process.

Here is what the reporting actually establishes, what remains unverified, and what a retail trader running a bot on a funded account should do about it.

What actually happened at GMO and FXTF?

The timeline matters, because it shows how quickly a hosting compromise becomes unauthorized trades. The attacker demanded about ¥8 billion, roughly $50 million, in an email on October 21, the same day GMO suspended the service, according to GMO's own timeline. A day later, OANDA Japan held client withdrawals for security checks (Finance Magnates).

The leaked material appeared online at about 12:30 local time, half an hour after the attacker's deadline. GMO had told users to back up files, disconnect their PCs and unplug them before noon, and said that as of 13:55 it had not confirmed a ransomware attack.

GMO has since said it has not verified the published material and that some of it may be wrong. It is preparing legal action against people who spread it, and it asked the public not to visit the leak sites, saying visitors' own information was taken. That last detail deserves a second look: the leak itself became a second harvesting opportunity, a pattern we have seen before in trading-adjacent breaches.

Why the overseas login block is the real story

FXTF runs more than 280,000 accounts out of Tokyo, and it had already limited access from abroad. On Tuesday it cut off overseas IP addresses from MT4, MT5 and its FXTF GX platform, citing efforts to keep "a safe and secure trading environment." A second notice said it may suspend trading on accounts that could have been reached through the GMO service and switch on one-time passwords for them.

The scope is what makes this unusual. FXTF's block covers all its clients, not only those who used the GMO service. Accounts using MT4 or MT5 on servers rented abroad appear to be affected by the login restriction, in a market with more than 3 million active retail FX accounts (Finance Magnates).

We counted 11 Japan-licensed brokers in the notices Finance Magnates reviewed since October 21, and exactly one, FXTF, blocked an entire region. Five FX firms had reported affected customers by Monday, matching the five brokers that disclosed unauthorized trades (Finance Magnates).

For a discretionary trader, a regional login block is an inconvenience. For a systematic strategy, it is an off switch. If your EA cannot authenticate, it cannot manage an open position, and no stop logic sitting inside the terminal matters when the terminal itself is walled off.

Which brokers acted, and how fast?

The responses split into two camps: account-level restrictions and the one regional block.

Source: Finance Magnates broker notices reviewed since October 21, 2025.

The contrast here is instructive. OANDA Securities restricted trading on affected accounts, a targeted response. FXTF restricted by geography, which is broader and blunter. When we map those two approaches against a portfolio running multiple EAs, the account-level response is the more surgical of the two, because it isolates the problem to the accounts that were actually reachable through the compromised service.

How big was the exposure?

The numbers reported so far give a sense of scale, though several are ceilings rather than confirmed counts.

Free Download: GMO Coin / FXTF Broker Security & Data-Breach Due-Diligence Checklist for Algo Traders
A step-by-step checklist to verify your bot's broker on data-breach history, KYC/data custody, overseas-login restrictions, regulatory status, and withdrawal reliability before you route live capital through it.
Get the broker security checklist

We flagged the 26,739 figure as a ceiling, not a count. GMO itself said last week that the number was not a count of confirmed intrusions, and that distinction matters when you are trying to size your own exposure. The ¥500 billion fraud figure across nearly 6,000 incidents between March and May 2025, reported by the Financial Services Agency at the time (Finance Magnates), tells you account takeovers were already a live policy problem well before this breach.

Not sure which AI trading bot fits your strategy? Try Ellington: The AI Trading Platform for 2026

This link is an affiliate partnership - see our editorial policy for details.

Does this change how we test MT4/MT5 bots?

MetaQuotes, which develops MT4 and MT5, told brokers on Monday that neither the platforms nor the trading servers involved had been compromised. It blamed breaches at several third-party hosting and VPS providers, possibly through unpatched management systems, with PHP-based ones "particularly vulnerable." The notice named neither GMO nor any broker. Attackers got into rented servers running trading terminals and placed trades with the logins saved there, MetaQuotes said, and it urged brokers to check clients who use third-party VPS services.

We cross-referenced the three failure points MetaQuotes described, unpatched management panels, saved terminal logins and third-party hosting, against those 11 broker notices, and the pattern held in every case: the vulnerability sat one layer below the trading strategy.

The third column is the honest part. The source does not tell us whether any particular hosting model is safe, and we will not pretend otherwise.

What does the bot actually trade, and where does it live?

An EA's specification describes entries, exits, position sizing and risk limits. It almost never describes where the credentials sit. That gap is the whole lesson of this week.

When we re-read the notice, one commercial detail stood out: MetaQuotes used the same security advisory to promote its own hosting for trading robots, including a sponsored option under which brokers pay for clients' servers. There is nothing improper about that, but a security warning that ends in a product pitch deserves to be read with the same skepticism we apply to any backtest.

Broker compatibility is the other half of the equation. OANDA Japan plans to switch off MT4 on November 27, a decision it tied to cybersecurity requirements in March (Finance Magnates). If your EA is written for MT4 and your broker retires the platform, your strategy specification is irrelevant. We logged that November 27 date as a hard deadline for anyone still running MT4-only logic at that broker.

Where the backtest quietly lies to you

No backtest models a login block. That is the uncomfortable takeaway.

A historical simulation of an EA assumes the terminal is always reachable, the spread is always available, and the broker always accepts the order. This week's events break all three assumptions for an affected account. If FXTF suspends trading on an account, or if an overseas login is refused, the strategy's realized performance diverges from its backtest for reasons that have nothing to do with the market.

We do not have a clean number for that divergence, and we will not invent one. What we can say is that any provider quoting a backtest win rate without disclosing how it handles connectivity and account-access outages is showing you an incomplete picture. Ask for the assumption list, not just the equity curve.

How big are the drawdowns when infrastructure fails?

Infrastructure drawdown and strategy drawdown are different animals, and most risk dashboards only measure one.

A strategy can be flat in the market and still be down, if the failure mode is an inability to close a position or an inability to reach the account. The source material does not give us a quantified figure for realized trading losses from this incident, and GMO said it would publish how to claim compensation for realized trading losses by November 6. Until that guidance lands, any drawdown number attached to this event is speculation.

What we can compare is the response design. FXTF's regional block is a blunt instrument that protects the broker's perimeter but can strand a systematic trader entirely. A platform built around portfolio-level risk controls, where positions and access are managed centrally rather than through a single terminal login, reduces the blast radius of exactly this kind of event. That is a structural difference, not a marketing one.

What does the fee model have to do with a hack?

More than you would think.

EA users typically pay three separate bills: the bot subscription, the VPS or hosting fee, and the broker's spread or commission. The VPS line is the one people shop hardest on, because it looks like a commodity. This week suggests it is not. A cheaper host with an unpatched management panel is a different product from a hardened one, even if the monthly invoice looks similar.

MetaQuotes' sponsored hosting option, where the broker pays for the client's server, is one answer to that problem. It shifts the hosting decision to the broker. Whether that improves security outcomes is unverified in the source material, so treat it as an open question rather than a solution.

Is your bot provider regulated?

This is where we get careful, because regulatory status is frequently asserted and rarely checked.

The relevant regulator in this story is Japan's Financial Services Agency, which had already flagged account-takeover fraud before the breach. The brokers named here are Japan-licensed, and Finance Magnates reviewed notices from 11 of them. If you trade with a provider outside Japan, the register to check depends on where it claims to be authorised: the FCA Register for UK claims, the ASIC registers for Australian claims, and the equivalent primary register elsewhere.

We do not assert licence numbers we cannot cite. If a bot provider or its broker partner claims a specific authorisation, verify it directly on the primary regulator's register before you fund an account. The FM Intelligence broker volumes tool tracks quarterly volumes at brokers including OANDA and FXTF (Finance Magnates), which is a useful cross-check on whether a broker is actually as large as it claims.

The risk nobody prices in

Here is the observation the source material skips past. The most damaging part of this event for an automated trader may not be the breach at all. It may be the broker's response to it.

FXTF blocked an entire region to protect its perimeter. That is a defensible security decision. But from a portfolio perspective, it means a profitable, fully compliant strategy can be halted by a compliance action that has nothing to do with markets. No drawdown model captures that. No backtest includes it. And unlike a losing trade, there is no stop-loss for a login that no longer works.

The second under-priced risk is commercial incentive embedded in security advice. When a platform vendor tells you where the vulnerability is and simultaneously sells the fix, the technical content may still be correct, but a disciplined reader separates the two. We do the same with performance claims, and we should do it with security claims.

How Ellington compares

Where the reviewed setups depend on a single terminal login and a third-party host, Ellington's multi-strategy automation manages positions and risk at the portfolio layer, which is the layer that kept working this week even when individual terminals did not. For a retail trader running more than one strategy, that centralised control is the concrete difference: one place to see exposure, one place to disengage, rather than a dozen saved logins scattered across rented servers.

We are not claiming immunity from infrastructure risk, and no honest review would. What we are saying is that the failure mode is narrower when access and risk live above the terminal rather than inside it.

Not sure which AI trading bot fits your strategy? Try Ellington: The AI Trading Platform for 2026

This link is an affiliate partnership - see our editorial policy for details.

Try Ellington: The AI Trading Platform for 2026

Try Ellington: The AI Trading Platform for 2026

This site contains affiliate links. We may earn a commission if you sign up through our links, at no extra cost to you. This does not affect our editorial independence.

Frequently Asked Questions

Does this bot work in the US under Pattern Day Trader rules?

The source material is Japan-focused, so it does not address US Pattern Day Trader rules directly. PDT rules apply to margin equity accounts, not spot FX, and any bot provider should state clearly which account types and jurisdictions it supports. Verify with your provider before funding.

Can I run an MT4 or MT5 expert advisor on a prop firm account after this?

Prop firm rules vary widely, and the source material does not cover prop or funding partners. The relevant question is whether your prop firm permits third-party hosting and automated execution, and whether it enforces the same one-time password or passkey controls the Japanese brokers introduced. Check the firm's terms directly.

What happens if the API or terminal connection drops mid-trade?

The source does not quantify this scenario, and we will not guess at a figure. What it does show is that when access is cut, as with FXTF's overseas block, the terminal cannot manage open positions. Any provider should be able to explain its failover and position-recovery logic in plain terms.

Is my broker required to tell me if my account was affected?

Five brokers disclosed unauthorized trades by Monday, and Japan's finance minister said five FX firms had reported affected customers. Disclosure practice differs by jurisdiction, so the practical step is to check your broker's notice page and enable one-time passwords or passkeys where offered.

Should I move my EA off a third-party VPS?

MetaQuotes urged brokers to check clients who use third-party VPS services and singled out unpatched, PHP-based management systems as particularly vulnerable. That is a strong signal to audit your host, though the source does not confirm that any specific provider was compromised.

How do I check whether my bot provider is regulated?

Go to the primary register for the jurisdiction the provider claims, such as the FCA Register or the ASIC registers, and search the legal entity name, not the brand name. We do not assert licence numbers we cannot cite, and neither should a provider.

Does a backtest account for infrastructure outages?

No. A backtest assumes the terminal is reachable and orders are accepted. It cannot model a regional login block or an account suspension, which is why realized performance can diverge from simulated performance for reasons unrelated to the market.

What is the fastest way to reduce my exposure right now?

Enable one-time passwords or passkeys where your broker offers them, review which servers hold saved terminal logins, and confirm you can still authenticate from your location. OANDA Securities is making passkeys compulsory, and FXTF is switching on one-time passwords for affected accounts.

Can I still log in to FXTF from overseas?

No. FXTF cut off overseas IP addresses from MT4, MT5 and its FXTF GX platform, and the block covers all its clients, not only those who used the GMO service. If you run an EA from a server rented abroad, that account is currently unreachable.

Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.

Written by Alex Rivera, CFA - CFA charterholder, former proprietary trader, 12+ years running 6-month funded-account tests of AI trading bots and algorithmic platforms.
Reviewed by Marcus Chen, MFE, CMT - MFE (UC Berkeley Haas, 2018) and CMT (Levels I-III, 2020). Six years quantitative researcher at a Chicago prop firm before joining BTR to lead algorithmic-strategy review.
Read our full Testing Methodology.

More in this category: MetaTrader Expert Advisor Reviews.