Five FX brokers have reported customer damage that is thought to be connected to GMO Internet's rental servers, Japan's finance minister told a press conference on October 27. The minister, who also holds the financial services portfolio, set out how the government understands the incident and what the Financial Services Agency has asked of the industry. Earlier Tokyo Brief coverage
How the trades happened
As the minister understands it, some FX customers who use automated trading tools had rented servers from GMO Internet. User information on those servers was viewed without authorisation, and trades the customers did not recognise were then placed through their FX brokers.
GMO Internet is a rental-server operator and not a business the FSA supervises, the minister said. The agency therefore worked through the brokers it does regulate.
What the FSA asked for
Last Thursday, the minister said, the FSA asked all FX brokers, through the Financial Futures Association of Japan, to warn customers to change passwords and check for trades they do not recognise, and to step up monitoring of customer trading.
By the day of the briefing, five brokers had reported customer damage that appeared related to GMO Internet. The minister named them as Golden Way Japan, OANDA Securities, Avatrade Japan, Gaitame Finest and Dukascopy Japan.
Safeguards at the five brokers
According to the minister, the five brokers already hold user information for the GMO Internet rental servers. Using it, they have temporarily suspended FX trading for the affected customers as a precaution, blocked unauthorised orders from overseas that are believed to come from the attacker, and reset the customers' passwords.
The minister said the FSA had received no report of new unauthorised trades and would keep responding "with a sense of tension". The minister added that GMO Internet has, as understood, announced that it will compensate for the losses.
Limits of the picture
Asked how many trades the five brokers handled and for what value, the minister said the figures did not appear to have been published. Asked about customers of overseas brokers, the minister said the ministry's authority extends only to domestically registered operators, so the FSA had secured that ground first.
The wider response
The minister said the Prime Minister told a cabinet-level cybersecurity meeting on October 26 to compile an emergency package by the end of the following week, and that the FSA is working on its input.
The minister also said the FSA has urged identity checks that read the IC chip in ID cards, which are considered effective against fraud. G7 members, meeting in Bangkok, agreed to hold a tabletop exercise next year on handling cross-border cyber incidents caused by frontier AI.