OANDA's Japanese brokerage held back client withdrawals requested today (Thursday) for security checks, after warning that hackers may have seen some clients' MetaTrader logins. The logins were stored on Onamae.com Desktop Cloud, a rented server service run by Japan's GMO Internet Group.GMO Internet said yesterday (Wednesday) that a third party had planted unauthorized programs in customers' server environments, which it detected on Tuesday. It began shutting down servers on every plan at 4 a.m. Wednesday and has not set a date for restarting them.London's trading industry is coming home!Up to 26,739 servers may be affected, GMO said. Retail FX traders rent them to keep MT4 and MT5 terminals and automated strategies running around the clock, and the MetaTrader logins stored on them belong to accounts at brokers such as OANDA.OANDA Securities is already moving clients off MT4, which it plans to switch off on November 27, citing cybersecurity requirements when it set the timetable in March.Japanese Brokers Have Been Tightening Logins Since 2025Japanese regulators have tracked account takeovers at online brokers since early 2025. Fraudulent trades on hijacked brokerage accounts exceeded ¥500 billion (about $3.2 billion) across nearly 6,000 incidents between March and May that year, according to the Financial Services Agency (FSA).IG's Japanese unit made two-factor authentication compulsory by June 2026, saying unauthorized access attempts were rising across the industry. OANDA has required authenticator codes for withdrawals since December 2025.MetaQuotes is changing how traders sign in, too. Its MetaTrader 5 beta build 6030 added unified client accounts secured with passkeys in July.Payouts Due by Friday AfternoonWithdrawals requested by 11 a.m. today will be processed from 11 a.m. on Friday, once security checks are complete, and should reach clients' bank accounts by 4 p.m., OANDA said. Requests made by 11 a.m. Friday follow the normal schedule.The withdrawal notice cites unauthorized access at "external services" without naming GMO. OANDA described the hold as a precaution against unauthorized withdrawals and said client assets remain segregated as Japanese law requires.In a separate notice, the broker asked clients who ran MetaTrader on the GMO service to change their account and MT4 or MT5 passwords, turn on two-factor login in MetaTrader and check their trade history. It said it was still deciding how to handle the matter from here.OANDA has been owned by Czech prop trading firm FTMO since FTMO agreed to buy it from CVC Asia Fund IV in 2025.No Confirmed Misuse So FarGMO said it had found no leak of personal information it holds and no misuse of data as of its announcement, and that it does not keep customers' card details. It told users to change any IDs and passwords stored on the servers and on other services where they reuse them.GMO has suspended new sign-ups. Its service terms offer a refund or credit when monthly uptime falls below 99.99%, and it said it will announce how it will handle this outage once it decides.The breach is the second security incident at GMO Internet Group this month. Masatoshi Kumagai, its chairman and chief executive, said on October 9 that all group services would be inspected after a data leak at a group research company, Nikkei reported.OANDA's warning covers clients running either of MetaQuotes' two retail platforms on the service. MT5 carried 65% of retail CFD volume on MetaQuotes platforms in the first quarter of 2026, FM Intelligence data show, against 35% for MT4.In Asia-Pacific, MT5 drew 1.5 million organic website visits in the third quarter, about twice the 709,700 for MT4, according to FM Intelligence's platform comparison.This article was written by Damian Chmiel at www.financemagnates.com.