Hackers gained unauthorized access to Onamae.com Desktop Cloud. They installed malicious programs in customer server environments, prompting the Japanese provider to suspend services across all plans.
The company identified 26,739 potentially affected servers and warned that information stored on those systems may have been viewed
GMO Internet, which operates Onamae.com, confirmed the malicious installations on October 20, 2026. Its October 21 disclosure announced rolling server shutdowns beginning at 4:00 a.m.
Japan time to prevent further damage while investigators examined customer environments. The notice provided no confirmed restoration date.
The figure represents potentially affected servers, not verified malware infections or individual customers.
The company’s incident notice does not identify the malware, initial access vector, exploited vulnerabilities, persistence mechanisms, or attacker infrastructure.
It also provides no hashes, malicious domains, or other indicators of compromise that customers could use for independent threat hunting.
Consequently, the disclosure does not establish whether attackers compromised a centralized management component, individual virtual servers, or another part of the service.
Onamae.com confirmed, malicious programs on only some customer environments, leaving the actual infection count and extent of unauthorized data access unresolved.
It likewise offers no basis for attributing the intrusion to a specific threat actor or classifying the malicious programs as ransomware, credential stealers, or cryptominers.
Onamae.com said it had not confirmed leakage of customer personal information entrusted to the company or misuse of information potentially viewed during the intrusion.
It separately stated that it does not retain payment information, including credit card details. These statements do not establish that data stored inside affected customer servers remained inaccessible.
Desktop Cloud provides remotely accessible virtual servers and is used to operate automated foreign exchange trading software.
That creates a direct connection between the infrastructure incident and potentially exposed trading credentials, alongside service disruption affecting continuously running workloads.
In a related development, OANDA Japan warned customers on October 22 that login IDs and passwords used with its MetaTrader 4 and MetaTrader 5 platforms on Desktop Cloud may have been viewed by third parties.
The broker’s warning extends the incident’s relevance beyond server availability to account security.
OANDA urged clients to change their My Page and MT4/MT5 passwords, enable available two-factor authentication, review trading histories, and contact support about suspicious transactions.
Its advisory did not establish that unauthorized trades had occurred; it outlined precautions against possible credential exposure.
Onamae.com instructed customers to change authentication information stored or used on their servers immediately. Customers who reused those passwords elsewhere were told to change them on those services as well.
The request makes credentials an immediate response priority, even while investigators determine the breach’s full scope.
The provider also warned about phishing messages and suspicious communications exploiting the incident. It emphasized that staff would never request passwords or credit card information by email or telephone.
The shutdown covers every Desktop Cloud plan, but the notice does not announce equivalent suspensions across Onamae.com’s other offerings.
Investigators are continuing server examinations, and the company said it would disclose further findings and announce service resumption once confirmed.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
