# The broker login sat on a rented desktop

2026-10-22

GMO says 26,739 Onamae desktop-cloud servers may be in scope and that trading-tool logins stored on those machines may have been taken and used. Customers have reported unauthorized trades. Change the broker password from a different computer.

Canonical: https://www.fabiocti.com/notes/the-broker-login-sat-on-a-rented-desktop/
Author: Fabio Correia

The VPS was the wallet. The broker was the next page.

GMO Internet’s second Onamae desktop-cloud notice, today: a third-party program was found on some customer servers on 20 October. Customers then reported unauthorized operations on trading accounts whose tools sat on those servers. The company now says login information stored on the machines — MT4, MT5, the rest — may have been taken and used. 26,739 servers may be in scope. All plans are stopped. New orders and the control panel went first. They do not hold card numbers on this service. They spoke to the police today.

The timeline in the notice: a customer query on the 19th, the program on the 20th, every plan stopped from 04:00 on the 21st. Their ask is specific. Change the broker password from a machine that is not this VPS. Log that session off. Read the trade history and the balance. Turn on the broker’s second factor if it has one. Anything else you stored on that desktop gets the same treatment.

## What 26,739 will be asked to cover

It will be briefed as GMO lost every Onamae domain. This is the rented Windows desktop, not the registrar. It will be briefed as a card file. They say the card is not on these disks. A used MT4 login is already a wire. It is not a finding that every server in the 26,739 hosted a book.

If you kept a trading tool on this product, do the reset from another computer before you argue about the count. If you never stored a broker login on it, you are still in the server ceiling until they subtract. A mail that asks you to “unlock the desktop” with a card number is someone else.

The desktop is off. The broker login does not turn off with it.