Onamae Desktop Cloud Suspends 27,000 Servers Following Malware Intrusion

Onamae Desktop Cloud, a prominent Japanese provider of virtual private servers (VPS), has suspended its operations after an intruder compromised its infrastructure and installed malware on approximately 27,000 customer environments.

The service, operated by GMO Internet Group, is one of Japan’s most popular hosting platforms, frequently used by automated foreign exchange (FX) traders for continuous operation of trading software like MetaTrader 4. The company confirmed on 20 October 2026 that an unauthorised third party had successfully deployed “malicious programs” within specific customer server segments.

Massive Service Disruption

Following the discovery of the breach, the provider initiated an emergency shutdown of affected systems. The suspension began at 04:00 local time on 21 October 2026, impacting all Desktop Cloud plans. According to the company, a total of 26,739 servers were potentially compromised by the unauthorised software.

While the investigation is ongoing, the company warned that data stored on the impacted servers may have been exposed to the attackers. However, it clarified that payment information, including credit card details, remains secure as it is hosted on a separate, isolated infrastructure that was not reached during this incident.

Recommendations for Affected Users

GMO Internet Group has not yet provided a scheduled date for the restoration of services. Customers who utilised the VPS for automated trading or sensitive data processing are facing significant downtime. The company has advised all users to take immediate security precautions once access is restored, including:

• Rotating all passwords and secrets stored on the servers;
• Updating API keys and digital certificates;
• Monitoring for potential phishing attempts targeting Onamae customers.

The provider cautioned that threat actors might attempt to exploit the incident through social engineering, warned that it will never request passwords or financial details via email or telephone.

Infrastructure Under Pressure

This incident highlights the systemic risks associated with infrastructure-as-a-service (IaaS) providers, where a single point of compromise at the management level can lead to the mass infection of thousands of downstream customer environments. The method of entry used by the attackers has not yet been disclosed.

The company stated it is currently conducting a forensic analysis to determine the full extent of the malware’s capabilities and to ensure the environment is sanitised before bringing servers back online. Updates are expected to be posted on the official Onamae.com service portal as the recovery process continues.