Asia's cyber wave hits brokers' rented servers, not the banks

A windowless white data centre building with a curved metal facade in Mitaka, Tokyo, and the street in front — NTT Data data centre in Mitaka, Tokyo, 14 November 2020 (illustrative archive photo; not a facility of the firms in the report)Photo: nakashi / Wikimedia Commons · CC BY-SA 2.0 · resized · Source

Why it matters

Noise: a 50 million dollar ransom and a noon ultimatum. Signal: on 27 October the attackers published data allegedly belonging to just 1 client, and no ransomware has been confirmed. MetaQuotes traced the breaches to third-party hosting and VPS providers, PHP-based systems in particular. In Japan 5 FX firms were affected; in Korea 19 financial firms were hit in October. The weak link is not the bank's core but the outsourced layer that carries trading orders.

Implications

GMO says 26,739 servers may have been affected; Finance Minister Katayama said on 27 October that 5 currency trading firms had reported client impact to the FSA.
In Korea, Daishin Securities reported a leak of data on 38,490 clients, and the presidential office held an emergency meeting with FSC officials on 28 October. Early in October the FSC had counted 16 institutions and about 100,000 leaks.
FXTF has blocked logins from overseas IP addresses on more than 280,000 accounts; GMO will set out how to claim compensation by 6 November. Security is being paid for with clients' freedom of access.

Noise

The 50 million dollar ransom and noon ultimatum show the scale of the crisis

Signal

The weak link is not the platform but the third-party hosting and VPS layer

Signal vs Noise ›

Map: Asia's cyber wave hits brokers' rented servers, not the banks

The ransom is noise; the signal is where the attackers got in

The headline of the attack on GMO Internet was the noon deadline that expired on 27 October and a ransom demand of about 50 million dollars. The company refused to pay. On 28 October it offered a reward of up to 1 million dollars for information leading to the attackers' capture. The material the attackers published on 27 October consisted only of data allegedly belonging to 1 client. As of 13:55 that day GMO had not confirmed a ransomware attack, and it had found no malware on the client computers it examined up to 11:59.

The key parameter is not the ransom but the point of entry. MetaQuotes, which develops the MT4 and MT5 trading platforms, told brokers on 26 October that its platforms and trading servers had not been compromised. The company traced the breaches to third-party hosting and VPS providers. A VPS is a rented remote computer that keeps a client's trading software running around the clock. MetaQuotes singled out PHP-based systems as especially vulnerable. The 26,739 servers GMO disclosed are therefore not a count of confirmed intrusions but a count of exposed doors.

One vulnerability, two countries

In South Korea on 28 October, Daishin Securities, Mirae Asset Global Investments and the crypto exchange Bithumb reported client data leaks in separate attacks. At Daishin, the names, email addresses and phone numbers of 38,490 clients were exposed. Early in October the Financial Services Commission said the wave had hit 16 institutions, banks among them, and produced about 100,000 data leaks. The science ministry and KISA also warned site operators about PHP flaws that allow commands to run on a server without logging in.

As of 28 October there is no evidence tying the attacks in the two countries to the same actor. What they share is the type of target. It is not the bank's core system but the thin, outsourced layer between client and market. Japan has more than 3 million active retail currency trading accounts, and some of them run trading software on remote desktops rented from providers such as GMO. In Korea, the leaks spread during October from banks to brokers, asset managers and a crypto exchange.

The state's definition of critical infrastructure lags behind

Japan's active cyber defence law, in force since 1 October, empowers the government to neutralise servers used in attacks. But the law was not designed to be triggered at the request of private companies, and GMO is not among the protected critical infrastructure operators. Prime Minister Sanae Takaichi asked the cabinet on 26 October for an emergency package within 1 week. Finance Minister Satsuki Katayama said on 27 October that 5 currency trading firms had reported client impact to the Financial Services Agency. She added that further unauthorised trades could not be ruled out.

In Korea, the presidential office held an emergency meeting on 28 October chaired by the 3rd Deputy Director of National Security. Both capitals are moving the incident to where the financial regulator meets the security bureaucracy. The constraint is this: critical infrastructure lists cover banks and exchanges, but the rented server that carries a client's trading order is often missing from them. The attacker is targeting not 1 protected institution but 26,739 unprotected doors.

The bill and the behaviour

The cost can already be measured. GMO will pay 5,000 yen to every user and 10,000–25,000 yen per category of information to clients whose data are confirmed as published. It will explain by 6 November how to claim for realised trading losses. Tokyo-based FXTF has cut off logins from overseas IP addresses entirely on more than 280,000 accounts. Of the 11 licensed firms Finance Magnates has reviewed since 21 October, FXTF is the only one to impose a regional block. OANDA Japan plans to shut down its MT4 service on 27 November.

What these steps have in common is that security is paid for with clients' freedom of access. In the near term this protects volumes; the president of SBI FX Trade said on 27 October that trading volumes had not fallen. Over the medium term, the rented server layer will either be brought inside the definition of critical infrastructure or brokers will take it in-house. Which path is chosen will show in the content of the package Takaichi wants within 1 week, and in the rule the Korean FSC issues after its emergency meeting.

Probabilities

Scenarios

Scenario	Probability	Trigger	Market impact
H1Contained spread, tighter regulation	55%	No new major data dump follows, the number of reporting firms stays flat and both governments announce packages bringing the rented server layer under supervision.	The incident turns into compensation and compliance costs; access restrictions become permanent but trading volumes hold.
H2Spillover to new providers	30%	The same PHP or VPS flaw is found at other hosting companies; more than 5 firms in Japan and more than 19 in Korea are affected.	Losses from unauthorised trades grow, firms move to regional access blocks and client attrition begins.
H3Rapid fade	15%	GMO's bounty leads to arrests and no new breaches are reported in November.	The issue fades quickly, the packages stay limited and the rented server layer remains outside the definition.

Module A

Constraints Matrix

STRUCTURAL AVG 3.7 · TACTICAL AVG 2.3Structural constraints dominate: the outcome is set more by these limits than by the actors' preferences.

Hard structural constraintspersistent · beyond the actors' will

Outside critical infrastructure · Japan
4/5
GMO is not among the critical infrastructure operators protected under Japan's active cyber defence framework; the law in force since 1 October was not designed to be triggered at a private company's request.
Widespread PHP flaw
4/5
MetaQuotes traced the breaches to PHP-based third-party hosting systems; in Korea KISA warned of the same type of flaw, which allows commands to run without logging in.
Wide attack surface
3/5
GMO says 26,739 servers may have been affected; Japan has more than 3 million active retail currency trading accounts.

Tactical frictiontemporary · eases over time

Attribution uncertainty weeks
3/5
As of 28 October there is no evidence tying the attacks in Japan and Korea to the same actor; the method behind the 3 new Korean breaches has not been disclosed.
Compensation timetable days
2/5
GMO will explain how to claim for realised trading losses by 6 November; until then the scale of client losses remains unclear.
Client cost of access restrictions weeks
2/5
FXTF has blocked overseas IP logins on more than 280,000 accounts; OANDA Japan plans to shut down MT4 on 27 November.

Module B

Signal vs Noise

SIGNAL 60% · NOISE 40%

NOISE
The 50 million dollar ransom and noon ultimatum show the scale of the crisis
On 27 October the attackers published data allegedly belonging to just 1 client; as of 13:55 GMO had not confirmed ransomware and found no malware on the computers examined.
Finance Magnates — Hackers Publish Alleged GMO Customer Data as Broker FXTF Shuts Out Overseas Logins
SIGNAL
The weak link is not the platform but the third-party hosting and VPS layer
MetaQuotes said on 26 October that its platforms and trading servers had not been compromised, and that the breaches came from third-party hosting and VPS providers, PHP-based systems in particular.
Finance Magnates — Hackers Publish Alleged GMO Customer Data as Broker FXTF Shuts Out Overseas Logins
SIGNAL
In Korea the wave is spreading from banks to brokers and a crypto exchange
Daishin, Mirae Asset and Bithumb reported breaches on 28 October; early in October the FSC had counted 16 institutions and about 100,000 leaks, and KISA warned about PHP flaws.
The Star (Reuters) — Three South Korean financial firms including Bithumb report data breaches, Yonhap says
NOISE
Clients are not leaving and trading volumes are unaffected
The president of SBI FX Trade said on 27 October that volumes had not fallen; yet 5 firms reported unauthorised trades and FXTF imposed a regional block on more than 280,000 accounts.
Finance Magnates — Hackers Publish Alleged GMO Customer Data as Broker FXTF Shuts Out Overseas Logins
SIGNAL
The Japanese state has put the incident on the financial regulator's agenda
Katayama said on 27 October that 5 FX firms had reported to the FSA and that further unauthorised trades could not be ruled out; the government urged financial institutions to strengthen their defences.
Bernama (Kyodo) — Japan's GMO Says Hacker Threatens To Disclose Customer Data At Noon

Module C

Asset-Class and Positioning Implications

Asset class	Exposure	Transmission channel	H1	H2	Expected	Conviction	Horizon	What to watch
Equities	Japanese and Korean retail brokers	Effect of compensation, compliance costs and access restrictions on the client base	−	−−	−1.15	●●●	0–3 months	GMO's compensation statement on 6 November and November earnings
Equities	Cybersecurity and managed hosting services	Security spending driven by the emergency packages and by brokers	+	++	+1.15	●●●	3–12 months	Budget lines in the Takaichi package and the Korean FSC rule
Credit	Operational risk premium on Japanese and Korean financial institutions	New breach reports and losses from unauthorised trades	0	−	−0.30	●●●	0–3 months	The number of new breach reports filed with the FSA and FSC

Second-order effects

And then what?

Starting point

The breach of GMO's rented server service turned into unauthorised trades at 5 currency trading firms; in Korea 3 more financial firms reported breaches the same week, and PHP-based external systems were flagged in both countries.

1
Operational riskwithin days
Brokers restrict access: overseas IP blocks, one-time passwords, mandatory passkeys and MT4 shutdowns spread from FXTF and OANDA to other firms.
Watch: GMO's compensation statement on 6 November and new access restrictions announced by other licensed FX firms
2
Regulationwithin weeks
Emergency packages in Tokyo and Seoul bring rented server and VPS providers under supervision or reporting obligations; compliance costs fall on brokers and hosting companies.
Watch: The content of Takaichi's emergency package and the Korean FSC rule after its emergency meeting
3
Cost of capitalwithin months
Compensation, compliance and client losses squeeze the profitability of small brokers; those unable to bring outsourced infrastructure in-house turn to mergers or exit the market.
Watch: Extraordinary cyber-related losses in November earnings and broker merger announcements

What breaks the chain

The chain stops at the first step if the attack method stays specific to GMO and no new unauthorised trades reach the FSA and FSC in November. Hosting providers quickly closing the PHP flaws would also stop it.

Triggers

Thresholds to watch

Indicator	Threshold	Today	What it means
VIX volatility index	> 20	16.91	Global volatility above 20 lifts retail FX trading volumes; in that environment, access restrictions and leaked login data magnify losses from unauthorised trades.

Sources

Sourcing and verification rules: methodology · Report an error: contact

Related reports

IICyber & Infrastructure·Analysis·Asia-Pacific

In Japan, the cyber bill lands on balance sheets, not policies

On 27 October Tokyo made a rare request to block an attacker's website. The quieter number sits elsewhere: GMO's 2031 bond spread widened 52 basis points in eight days, because Japanese policies exclude ransom and often business interruption.

Cyber & Critical Infrastructure Desk · 30 October 2026 · 6 min

VTech & AI·Analysis·Asia-Pacific

AI chips are concentrating Asia's growth in a single line item

Korea grew 1% on 27 October and chips carried half of it. The same day brought reports that TSMC would raise packaging prices by up to 20%. The headline reads as strength. The constraint is growth tied to one cycle and packaging lead times that have doubled.

Technology Geopolitics Desk · 27 October 2026 · 7 min

IICyber & Infrastructure·Analysis·Asia-Pacific

The PHP patch is out, but Asia's attack window remains open

CYFIRMA said on 24 October that a Korean-speaking group is using PHP2Shell to target governments and banks in 9 countries. The headline is Lazarus, but the constraint lies in unpatchable servers dating back to 2012.

Cyber & Critical Infrastructure Desk · 25 October 2026 · 7 min