GMO Unauthorized Access Perpetrator's Claim Statement Viewer

What happened

In October 2026, a person using the name Dmitry Orlov sent emails to GMO staff. The emails claim the sender hacked Onamae Desktop and Onamae Cloud VPS. The sender then said the hackers could delete balances in customers' MT4 and MT5 trading accounts. The sender posted the messages and screenshots on a website. GMO has said it received a threat. The hacker's claims about the damage, the method of entry, and GMO's mistakes have not been confirmed.

Key numbers and facts

• First email sent on October 21, 2026, with a deadline of 2:00 PM Japan time that day.
• The hacker said it would delete about 500,000 dollars from customer accounts every five minutes, starting at 5:00 PM.
• The hacker claimed that a total of about 280 million dollars in balances would be deleted two hours later.
• The hacker said it had already deleted one account with 11,655,288 yen, and later reported destroying accounts with a total of 1,623,498 dollars.
• The hacker said it would delete the balances of any customer it was contacted about, and encrypt the customer's local PC.

Background

MT4 and MT5 are popular programs that people use to trade money on currency markets. Each trading account is held by a broker. A cloud server, such as a VPS, is a computer that runs in a data center and can be used from far away. The hacker said it used a remote login feature called RDP drive redirection to reach customers' home computers. These are the hacker's claims and have not been checked.

Why it matters

If the claims are true, customers could lose real money, and their own computers could be taken over. Even if some claims are exaggerated, the story shows how a company that runs online services can be pressured by criminals. People who use trading accounts or online hosting should check their own accounts and follow the company's official notices.

What to watch

• Whether GMO confirms the break-in and how many customers were affected.
• Whether the account balances reported by the hacker are real.
• Whether the hacker carries out its threat to delete more balances.
• Whether police or security experts publish findings about the attack.