GMO Internet Group founder Masatoshi Kumagai said on Monday in Tokyo that the group's internal security team had warned as early as 2024 about a vulnerability in a trading-server service that was later hacked. The group also decided to cut the pay of four executives, with Kumagai himself taking a 30% monthly salary reduction for three months.

The affected service, Onamae.com Desktop Cloud, mainly rents Windows servers that can run MetaTrader around the clock. As many as 26,739 servers may have been exposed, and several brokers confirmed that hackers used stolen login credentials to place trades in client accounts. The service remains offline.

Kumagai said GMO Cyber Security, a subsidiary of the group, had reported a vulnerability in April 2024. Four rounds of emergency maintenance were carried out in April and May, but none addressed the root cause. Under the internal reporting process in place at the time, the risk report did not reach management. The group is now discussing changes to its escalation procedures. He said the warning ultimately failed to be acted upon or integrated into service operations.

Kumagai reiterated that GMO would never pay ransom to attackers. Hackers had previously threatened to release customer data if GMO did not pay by Oct. 27. After the deadline, they began publishing files they claimed contained customer information.

The group also cut pay for executives in the affected business. Tadashi Ito, deputy CEO of the group and president of GMO Internet, the listed subsidiary that operates the service, will take a 25% pay cut. Two executives at the same subsidiary, Hirofumi Yamashita and Kimihiro Kodama, will each take 20% cuts. The four pay reductions will begin with December salaries and last three months. GMO said in a statement that the cuts were an interim response and that management accountability would be reassessed after a full review of the breach.

The group has paid every user of the service 5,000 yen, or about $31, and pledged to reimburse actual losses caused by unauthorized trades. It said it would announce the claims process on Friday. In a filing with the exchange last Wednesday, it said total losses could not yet be calculated.

Two brokers whose clients were affected by the intrusion told users on Monday that they had experienced separate system problems unrelated to the hacking incident. OANDA Japan said withdrawal instructions were blocked because of a system failure at partner bank Docomo Mitsui Sumitomo Trust Bank. Customers who submitted withdrawal requests between 11:00 on Friday and 11:00 on Monday were affected, and the bank had not given a repair timetable. Payments scheduled for Monday will be reinitiated on Wednesday, and customers do not need to submit new requests. This is OANDA's second withdrawal delay in less than two weeks; after GMO was breached on Oct. 22, OANDA suspended withdrawals for a day.

FXTF, which has more than 280,000 accounts, said a configuration error caused its MT4 platform to perform client margin checks at 13:30 instead of the usual 15:30 to 15:45 window. The check verifies whether account margin is higher than 100% of the required margin. FXTF apologized and said it would review its system settings and management procedures, without disclosing how many accounts were affected. OANDA also said that due to internal workload, new account-opening applications submitted after Friday will take three to four business days to process.