[Follow-up] お名前.com VPS unauthorized access — urgent request to change the password of your transaction account and to “disconnect the session”

What I would like you to do as a top priority (summary of the service provider’s guidance)

①Change your trading account and MT4/MT5 passwords urgently.Please perform the change from devices you are not using for FX trading (smartphones or another PC).

②Disconnect all active sessions.Even after changing the passwords, depending on the provider’s server settings, existing connections may remain for a certain period. During that time, a third party could trade, so please perform a complete session disconnection on the provider’sMy Page or contact desk. Even if you have already changed your password, be sure to do this.

③Check transaction history and balances.If there are unfamiliar transactions, first contact the relevant trading partner.

④If two-factor authentication is available, enable it.

⑤Run a full virus scan on your own PC/smartphone and back up your data.In the latest fourth notice (October 24), the provider also lists this as an “urgent” measure. Please handle backed-up files with care.

・Stored on the servers,login information for trading accounts, etc., may have been obtained by a third party and used fraudulently(Previously it said “information may have been viewed”).

・As a result of the investigation, there were security issues in the system and a fact that customerinformation was exfiltratedwas confirmed.

・From some customers, reports of unfamiliar trades in trading accounts have been received.unrecognized tradeshave been reported.

・The affected servers number 26,739 (this is the number that could potentially be affected; it is not the number of confirmed data breaches).

・Currently, all servers of all plans remain stopped.The reopening time is undetermined.

① Relief payment (compensation):All customers currently using this service will receive a uniform5,000 yenregardless of financial loss. Instructions, procedures, and timing will be sent to the registered email address byOctober 30 (Fri) 23:59.

② Alternative service:Rather than simply restarting the current system, the provider has decided to overhaul the platform. For those who want to continue using a Windows desktop environment, there will be a migration to an independent cloud platform as an alternative service,free for six months. The migration will not occur without the customer’s consent. Start date and application method will be announced by email byOctober 30 (Fri) 23:59.

③ Compensation for losses due to fraudulent transactions:Compensation covers actual losses incurred from transactions initiated without the customer’s consent,realized losses(including spreads and fees). Losses due to market fluctuations or profits that should have been gained are not covered. Transactions identified by the provider’s investigation are eligible, and application procedures and required documents will be announced byNovember 6 (Fri). You are also requested to contact counterparties about cancellations or refunds.

・There have been reports of threats from attackers.The provider’s announcements mention continued unauthorized control of trading accounts, exposure of information on customers’ PCs, and ransomware attacks. The provider states they will not respond to the attackers’ demands and have submitted all evidence to the police.

・In the future, attackers may publish what they call information.Contents may differ from the facts. Please confirm official information from the provider’s announcements.

・Even if you receive emails or messages from someone claiming to be the attacker, do notopen URLs or files, and do not reply.

・Beware of impersonation scams that pose as compensation or refunds.The provider will not ask for password, credit card, or account information via email or phone.

・(Preventive measures) Please run a full antivirus scan on your PC or smartphoneand back up your data. Please handle backed-up files with care. Also, change IDs and passwords saved in the browser.

①Changed trading account and MT5 passwords, and disconnected all sessions:We changed the passwords for the trading account and MT5 and disconnected all active sessions.

②Checked trading history and balances:We checked the trading history and balances and foundno unfamiliar trades.

③Handling of holdings (averaging doll and flexible EURUSD)We did not close positions and continued to hold. The four-layer short positions (0.01, 0.02, 0.03, 0.05 lots) were closed in profit (TP) on October 22 at the same price, for a total profit of+1,751 yen. The profit-taking instruction is registered on the provider’s server, so the EA trades even when halted. Currently, onlyone long layer (initial lot) remains. This is a held position that was built on October 20 at 18:12 before the stop. Since the EA is halted, this position cannot be managed.

①During the stoppage, the period will be left blank and expressly stated.We will not augment the results afterward or present them prettily.

②We will record the restart date.We will indicate where the pre-stop ends and the post-restart begins.

③We will report everything that happened during the stop, without hiding it.