Hackers breach Japan's Onamae Desktop Cloud, affecting up to 27,000 servers

GMO Internet-owned VPS provider confirms unauthorized access and malicious program installation; service suspended since October 21

By LineZotpaper

Published21 October 2026

Read Time2 min

Hackers have compromised the infrastructure of Onamae Desktop Cloud, a popular VPS provider in Japan operated by GMO Internet, installing malicious programs on up to 26,739 customer servers. The company confirmed the breach on October 20 and began shutting down affected servers from 4 a.m. local time on October 21, with no estimated restart date.

Onamae.com, part of the GMO Internet Group and one of Japan's largest domain registrars, disclosed that an unauthorized third party gained access to its Desktop Cloud service and installed malicious programs in some customer environments. The Desktop Cloud byGMO service is marketed as ideal for stable automated forex trading, including continuous operation of MetaTrader 4 (MT4).

In an announcement, the company stated, "We have confirmed that unauthorized access by a third party occurred against Onamae.com Desktop Cloud and that unauthorized programs were installed in some customers' server environments." The breach may have exposed data stored on the impacted servers, though GMO has not confirmed any misuse or leakage. The company emphasized that payment information such as credit card details is not affected as it is stored on separate infrastructure.

Customers are advised to rotate any passwords or secrets stored on their servers as they may be compromised. GMO also warned of an increased risk of phishing emails attempting to extract sensitive information, stating, "We will never ask you for your password or credit card information via email or phone."

The service interruption began at 4 a.m. local time on October 21, affecting all Desktop Cloud plans. GMO said it will provide updates as the investigation continues but has not given an estimated restart date.

Analysis

Why This Matters

The breach affects up to 26,739 servers, potentially exposing sensitive data of customers using the VPS service for automated forex trading and other operations.
Service disruption impacts traders and businesses relying on continuous operation of platforms like MetaTrader 4.
The incident raises concerns about the security of cloud infrastructure provided by major domain registrars and internet service providers.

Background

Onamae.com is one of Japan's largest domain registrars, operated by GMO Internet, a member of the GMO Internet Group. Its Desktop Cloud service offers VPS hosting optimized for automated forex trading, a popular use case in Japan. The company also provides web hosting, DNS, and other internet infrastructure services.

Key Perspectives

GMO Internet (Onamae.com): The company has acknowledged the breach, taken the service offline, and is investigating. It has advised customers to rotate secrets and remain vigilant against phishing. Payment information is confirmed unaffected due to separate storage.n Affected customers: Users of Desktop Cloud face service downtime and potential compromise of credentials or data stored on their servers, particularly traders relying on automated systems.n Critics/Skeptics: The absence of a confirmed data misuse does not rule out future leaks, and the broad impact (all Desktop Cloud plans shut down) suggests a significant compromise that may take days or longer to resolve.

What to Watch

Service restoration timeline and whether GMO provides a clear schedule for resuming operations.
Any evidence of data exfiltration or subsequent misuse, which could expand the scope of harm.
Investigation findings on how the attackers gained access and whether other GMO services are affected.

Sources

Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected · BleepingComputer

Checked

12 claims in this story checked against 1 source: 11 supported.

Show each claim

SupportedHackers breached Onamae Desktop Cloud, affecting up to 27,000 servers.BleepingComputer: “Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected. Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers.”
Partly supportedGMO Internet-owned VPS provider confirmed unauthorized access and malicious program installation.BleepingComputer: “The company confirmed on October 20 that an unauthorized third party installed "malicious programs" in some customer environments. Onamae.com, operated by GMO Internet, a member of GMO Internet Group”
SupportedThe service interruption began on October 21 and has no estimated restart date.BleepingComputer: “The company announced a service interruption starting today at 4 a.m. (local time), noting that all Desktop Cloud plans will be impacted. No estimated date has been provided for restarting the service.”
SupportedThe company confirmed the breach on October 20.BleepingComputer: “The company confirmed on October 20 that an unauthorized third party installed "malicious programs" in some customer environments.”
SupportedThe company began progressively shutting down customer servers at 4 a.m. local time on October 21.BleepingComputer: “After detecting the intrusion, the company says it progressively shut down customer servers beginning at 04:00 local time on October 21, 2026.”
SupportedThe company’s statement says unauthorized access occurred and unauthorized programs were installed in some customers’ server environments.BleepingComputer: ““We have confirmed that unauthorized access by a third party occurred against Onamae.com Desktop Cloud and that unauthorized programs were installed in some customers’ server environments,” reads the announcement.”
SupportedThe breach may have exposed data on impacted servers, but the company has not confirmed information was misused or leaked.BleepingComputer: “According to the alert, the breach may have exposed data stored on the impacted servers. However, the company has not confirmed any instance of information being misused or leaked.”
SupportedPayment information, including credit card details, is unaffected because it is stored on separate infrastructure.BleepingComputer: “The company also emphasizes that payment information, such as credit card details, is not affected because it is stored on a different infrastructure.”
SupportedCustomers are advised to rotate server-stored passwords or secrets because they may have been compromised.BleepingComputer: “Customers who stored secrets, such as passwords, on their servers are advised to rotate them as soon as possible, as they may have been compromised.”
SupportedThe company warned of increased phishing risk and said it would never request passwords or credit card details by email or phone.BleepingComputer: “The company also noted an increased risk of phishing emails and other unsolicited communications, as threat actors may try to exploit the incident to convince customers to disclose sensitive information. “We will never ask you for your password or credit card information via email or phone,” the company says.”
SupportedThe service is marketed as ideal for stable automated forex trading, including continuous MT4 operation.BleepingComputer: “Its Desktop Cloud byGMO service is advertised as "ideal for stable FX automated trading, including continuous operation of MetaTrader 4 (MT4)."”
SupportedThe company will provide updates as the investigation continues, but has not given an estimated restart date.BleepingComputer: “As the investigation continues and more details become available, GMO says it will provide updates. The company announced a service interruption starting today at 4 a.m. (local time), noting that all Desktop Cloud plans will be impacted. No estimated date has been provided for restarting the service.”