Hackers breach Japan's Onamae Desktop Cloud, plant malware on up to 27,000 servers

Attackers compromised the infrastructure of Onamae Desktop Cloud, a Japanese virtual private server (VPS) service operated by GMO Internet, and installed malware on up to 26,739 customer servers, BleepingComputer reported on October 21, 2026. The company confirmed on October 20 that an unauthorized third party had installed "malicious programs" in some customer environments, and it began shutting down customer servers at 04:00 local time on October 21. No restoration date has been given.

What happened

Onamae.com, operated by GMO Internet, a member of GMO Internet Group, is one of Japan's largest domain registrars and also offers web hosting, DNS and other infrastructure services. According to BleepingComputer, the affected product, Desktop Cloud byGMO, is marketed for automated foreign exchange trading, including round-the-clock operation of the MetaTrader 4 (MT4) platform.

After detecting the intrusion, the company progressively shut down customer servers. BleepingComputer reports that all Desktop Cloud plans are affected. The company said it will share updates as its investigation continues.

What is known and unknown

According to BleepingComputer, the company has not disclosed how the attackers gained access to its infrastructure, who is behind the attack, what their motives are, or what the installed malware does. The impact has been described in terms of servers rather than a confirmed number of distinct customers.

The breach may have exposed data stored on affected servers, but the company says it has not confirmed any misuse or leak of information. Payment information, including credit card details, is reportedly unaffected because it is stored on separate infrastructure.

The incident is notable because of how the service is typically used. Servers running automated trading platforms often hold brokerage account credentials, API keys and other sensitive secrets, which could make them valuable to attackers if the installed malware was designed to collect such information. Whether that is the case has not been confirmed.

What to do

The company and BleepingComputer recommend that Desktop Cloud customers:

• rotate any passwords or other secrets stored on their Desktop Cloud servers as soon as possible, including trading platform and brokerage credentials;
• be cautious of unsolicited emails, messages or phone calls that use the incident as a lure; the company says it will never request passwords or credit card information by email or phone;
• follow official GMO and Onamae.com announcements for restoration timelines and further findings.

Customers should also review recent activity on any brokerage or exchange accounts that were accessed from these servers and enable multi-factor authentication where available. Once services return, rebuilding environments from clean images rather than reusing existing system state would reduce the risk of persistent compromise.