Onamae Desktop Cloud Hack Affects Up to 26,739 Servers in Japan
Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular VPS service in Japan, and installed malware in the server environments of up to 26,739 customers.
Onamae confirms unauthorized access and malware installation
On October 20, Onamae.com confirmed that an unauthorized third party had accessed its Desktop Cloud service and installed a “malicious program” in some customer environments.
“We have confirmed that a third party has gained unauthorized access to Onamae.com Desktop Cloud, and that a malicious program has been installed on some customers’ server environments.” Read the company’s announcement.
Operated by GMO Internet, a member of the GMO Internet Group, Onamae.com is one of Japan’s largest domain registrars. The company also provides internet infrastructure services, including web hosting and DNS.
Desktop Cloud servers taken offline after breach
After detecting the intrusion, the company announced that it would gradually shut down customer servers starting at 4 a.m. local time on October 21, 2026.
The affected service, “Desktop Cloud byGMO,” is promoted as an infrastructure platform for stable automated foreign exchange trading, including continuous operation of MetaTrader 4 (MT4).
The outage affects all Desktop Cloud plans, and the expected date for service resumption has not been determined.
Customer data may have been exposed
According to the alert, data stored on affected servers may have been exposed. However, no cases of information misuse or leakage have been confirmed.
GMO also emphasized that payment information, including credit card details, is stored on separate infrastructure and is not affected by the incident.
The company says it will provide additional updates as its investigation continues and more details become available.
What Onamae customers should do
Customers who stored secrets such as passwords on their servers are encouraged to rotate them as soon as possible because their security may have been compromised.
Customers should also watch for phishing emails and other unsolicited communications. Attackers may attempt to exploit the incident by impersonating Onamae or GMO and persuading customers to disclose sensitive information.
The company says it “will never ask for passwords or credit card information via email or phone.”
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com