Onamae Desktop Cloud Incident Impacts 27,000 Servers in Japan

Japanese internet giant GMO Internet has suspended its Onamae Desktop Cloud service following a significant security breach that resulted in malware being installed on nearly 27,000 customer servers.

The company confirmed on 20 October 2026 that an unauthorised third party gained access to its infrastructure and deployed “malicious programs” within various customer environments. In response to the discovery, the provider initiated an emergency shutdown of affected systems beginning at 04:00 local time on 21 October.

According to an incident notice issued by GMO Internet Group, the compromise affected up to 26,739 servers. Onamae.com is one of Japan’s most prominent domain registrars and infrastructure providers; its Desktop Cloud service is specifically marketed as a stable environment for automated foreign exchange (FX) trading, primarily for users running MetaTrader 4 (MT4) platforms.

Potential Data Exposure

The company warned that while the primary intent appears to have been the installation of malware, the breach may have exposed data stored on the compromised servers. This includes sensitive credentials, configuration files, and automated trading data.

However, the provider emphasised that customer payment information, including credit card details, was not affected by the incident. Financial data is managed on a separate, isolated infrastructure that was not reached during this intrusion.

At the time of writing, all Desktop Cloud service plans remain suspended. The company has not yet provided an estimated date for when the infrastructure will be cleaned and brought back online.

Security Guidance for Users

Customers who utilised the service are being urged to treat any secrets or credentials stored on their virtual servers as compromised. The provider recommends that users rotate all passwords, API keys, and authentication tokens immediately across any connected services.

There is also an elevated risk of targeted phishing attacks. Threat actors often leverage the disruption following a high-profile breach to trick users into disclosing further sensitive information through fraudulent support emails or phone calls. The company reiterated that it would never ask for passwords or credit card information via these channels.

The incident highlights the growing risks facing Virtual Private Server (VPS) infrastructure, where a single point of failure at the management level can grant attackers broad access to thousands of isolated customer instances. This follows a trend of increasing sophisticated attacks against Japanese digital infrastructure, where automated trading and financial services are high-value targets for cyber-criminal groups.