Onamae Desktop Cloud breach may hit 26,739 GMO servers

GMO Internet confirmed on 20 October 2026 that an unauthorized third party installed malicious programs on customer environments inside Onamae Desktop Cloud, its Windows-focused VPS platform. The company says the intrusion affects up to 26,739 customer servers and began progressively shutting them down at 04:00 JST on 21 October. All Desktop Cloud plans are offline with no restart date announced. If you run a Desktop Cloud instance, assume compromise and rotate everything stored on it.

What's affected

Onamae.com, operated by GMO Internet Group, is one of Japan's largest domain registrars and also sells hosting and the Desktop Cloud service — a hosted Windows desktop popular for running FX automated-trading tools such as MetaTrader 4 around the clock. GMO's notice, as reported by BleepingComputer and Japanese security outlet Rocket-boys Security Lab, states:

• The 26,739 figure is the number of servers that could be affected — not a confirmed infection or data-theft count.
• Data stored on affected servers may have been exposed, but GMO has not confirmed misuse or leakage.
• Payment data, including credit-card details, is held on separate infrastructure and is reportedly not affected.

GMO has not published the entry vector, the malware family, or any CVE. We have not seen GMO's original Japanese advisory in a stable public URL; this post is based on GMO's statement as relayed by the outlets above.

Exploitation status

The malware was placed by the intruder inside customer environments — this is an active compromise, not a theoretical flaw. GMO has attributed nothing and named no actor. No IOCs have been published.

Action checklist

1. Treat any secret stored on a Desktop Cloud server — passwords, API keys, trading-platform credentials, SSH keys, saved sessions — as exposed, and rotate it from a clean machine.
2. Do not wait for service restoration to rotate; the credentials are the risk, not the uptime.
3. Watch for incident-themed phishing. GMO says it "will never ask you for your password or credit card information via email or phone" — treat any such message as hostile.
4. If you ran unattended automation (FX bots, scheduled jobs) on the instance, review its downstream accounts and brokerage API keys for misuse.
5. Follow GMO's updates for the eventual disclosure of vector and scope.

Context

A hosting provider that pre-positions malware across tens of thousands of tenant servers is the worst case for shared infrastructure: the customer did nothing wrong and still inherits the breach. The honest read today is narrow — GMO has confirmed intrusion and malware placement and pulled the platform, but has not said how, what was taken, or who. The actionable fact is the one that doesn't need those answers: anything that lived on a Desktop Cloud server should now be considered in the attacker's hands.