GMO Internet Onamae.com Desktop Cloud Breach: All Plans Shut Down After Malicious Programs Found on Customer Servers

GMO Internet, the Japanese hosting provider, says a third party gained unauthorized access to its Onamae.com Desktop Cloud service and installed malicious programs in some customers' server environments. GMO puts the number of servers that could be affected at 26,739, and its third report stresses that this is not a count of confirmed cases (see below). To stop further damage, it began shutting down servers on all plans in sequence from 04:00 Japan time on 21 October 2026 (22:00 Cyprus time on 20 October). The service remains suspended, and GMO has not given a date for bringing it back.

GMO's second report (22 October) said customers had reported unauthorized operations on their trading accounts, and that trading account login information and other data stored on the servers may have been obtained and used illegally. In its third report, as of 16:10 Japan time (10:10 Cyprus time) on 23 October, GMO urgently asks customers to change trading account and trading tool passwords and to disconnect all logged-in sessions. It warns that, depending on the broker's systems, existing sessions may stay connected for a period after a password change, and a third party may be able to keep trading. GMO says whether, and to what extent, information was obtained or misused in individual cases is still under investigation, and that the investigation includes the impact on customers' own devices. GMO has consulted the police, says it is reporting to and consulting the relevant authorities, and is investigating with an external cybersecurity firm. Some facts are less alarming. GMO says it does not keep customers' payment information, including credit card data, on the service's servers. GMO has not said how the attacker got in. No CVE has been linked to the incident.

Technical Information

What the service is. GMO's service site markets Onamae.com Desktop Cloud as an 「FX自動売買専用VPS」 (a VPS dedicated to foreign exchange auto-trading), 「MT4/MT5対応」 (compatible with MetaTrader 4 and MetaTrader 5), for running trading programs and indicators 「24時間」 (around the clock). Customers' trading tools, and the account credentials saved in them, run on these servers.

What GMO has said (first report, 21 October; second report, 22 October; third report, 23 October, Japanese only; Japanese originals on onamae.com, onamae.com, second report and onamae.com, third report):

• A third party "installed malicious programs in the server environments of some customers."
• "Number of servers potentially affected: 26,739". It is not a count of customers, and the third report says it is not a count of confirmed cases either: 「※上記は対象となり得るサーバー数であり、不正アクセスまたは情報取得が確認された件数ではありません。」 ("The above is the number of servers that could be in scope, not the number of cases in which unauthorized access or the obtaining of information has been confirmed.")
• "Information stored on the servers may have been viewed."
• The second report adds that "this unauthorized access may have allowed a third party to obtain trading account login information and other data stored on the servers, and to use it illegally." (Japanese original: 「本件不正アクセスによって、サーバー内に保存されていたお取引口座のログイン情報等が第三者に取得され、不正に利用された可能性があることが分かりました。」) It lists the information potentially affected as: "Information stored on the servers (including trading account login information saved in trading tools)".
• The service-site notice, as updated on 23 October, cites the customer reports and, as a precaution, says credentials such as passwords for brokerage and FX trading tools (MT4/MT5 and similar) and trading accounts used on the servers "may have been viewed by a third party", and asks users to change them urgently and log off (disconnect their sessions). (Japanese original: 「証券会社・FX会社等の取引ツール（MT4/MT5等）ならびにお取引口座のパスワード等の認証情報が第三者に閲覧された可能性があり、至急、パスワードの変更ならびにログオフ（セッションの切断）をお願い申し上げます。」)
• The third report adds: 「個別の情報取得および不正利用の有無・範囲については、引き続き調査中です。」 ("Whether, and to what extent, information was obtained and misused in individual cases is still under investigation.") GMO says its investigation includes the impact on customers' devices, and that it has consulted the police, is working with the relevant companies to confirm the damage and prevent it from spreading, and is reporting to and consulting the relevant authorities.
• GMO says it does not store customers' payment information, including credit card information, on the service's servers. The third report adds that information customers themselves stored on the servers is within the scope of impact.
• GMO is investigating "the intrusion route and the scope of impact" with an external cybersecurity firm. It has not disclosed how the attacker got in or what the malicious programs do.

What GMO said about personal data, and what changed. In the first report (as of 04:00 Japan time on 21 October), GMO said: "At this time, we have not confirmed any leakage of customers' personal information entrusted to us, nor any misuse of information that may have been viewed." (Japanese original: 「現時点において、お預かりしているお客様の個人情報の漏えいや、閲覧された情報が悪用された事実は確認されておりません。」) That was GMO's first-report position, an early "not confirmed", not a finding that no data was taken. Earlier versions of the service-site notice carried a similar line, which GMO removed by 15:50 Japan time (09:50 Cyprus time) on 23 October. Neither the second nor the third report repeats it. Both cite customer reports of unauthorized trading account operations and say login information stored on the servers may have been obtained and misused, and the third report says individual cases are still under investigation.

Timeline (as GMO reports it; Japan time, with Cyprus time, UTC+3, in brackets):

• 19 October: GMO begins investigating after a customer inquiry.
• 20 October: GMO confirms that malicious programs were installed. It suspends new applications and the control panel.
• 21 October, 04:00 (20 October, 22:00): GMO begins shutting down servers on all plans in sequence and publishes its first report.
• From 21 October: Customers report operations on their trading accounts that they do not recognise. GMO shares the situation with "the relevant companies" and asks them to help guide customers.
• 22 October: GMO consults the police.
• 22 October, 16:59 (10:59): GMO publishes its second report.
• 23 October, by 15:50 (09:50): GMO updates its service-site notice, adding the customer reports and the urgent password-change and log-off request and removing its earlier line on personal data. GMO does not date the change; we saw it live by this time.
• 23 October, 16:10 (10:10): GMO publishes its third report in Japanese, also posted on onamae.com. The resumption date is still undetermined.

National CERTs. As of 23 October 2026, 10:20 Cyprus time, JPCERT/CC, IPA and Japan's National Cybersecurity Office (formerly NISC) have published nothing specific to this incident. JPCERT/CC's current general alert on unauthorized access at Japanese organizations does not mention GMO. No CVE has been assigned or linked to it, so there is nothing to check in CISA's Known Exploited Vulnerabilities catalog.

Affected Product Versions

This is a service incident, not a software vulnerability, so there are no product versions to patch.

GMO has not said whether any of its other services are affected. Its notices cover Onamae.com Desktop Cloud only.

Workaround and Mitigation

For Onamae.com Desktop Cloud customers who use securities or FX trading tools (such as MT4/MT5) on the service, GMO's third report (23 October) lists urgent steps (1 to 6), a preventive step (7) and a scam warning (8):

1. Change trading account and trading tool passwords now, from a device you do not use for FX trading, such as a smartphone or another PC.
2. Disconnect all logged-in sessions, including by contacting the broker. GMO warns that, depending on the broker's systems, existing sessions may stay connected for a period even after a password change, and a third party may be able to keep trading. Check the broker's guidance or account page and end all sessions, or ask the broker to. GMO says to do this even if you have already changed your password.
3. Check the transaction history and balance of trading accounts. If you see trades you do not recognise, contact the broker first.
4. Turn on two-factor authentication if the broker offers it.
5. Change any other credentials (IDs, passwords and similar) stored on or used from the server, any reused elsewhere, and IDs and passwords saved in your browser.
6. Do not engage with messages from anyone claiming to be the attacker. GMO asks customers not to open links or files in such messages and not to reply.
7. As a precaution, scan and back up your own devices. GMO asks customers to run a full antivirus scan on their own PCs and smartphones and to back up their data, taking care with how they handle the backup files. GMO calls this a preventive step against secondary damage, and also asks customers to recheck how they manage passwords across services and to turn on multi-factor authentication.
8. Watch for scams exploiting the incident: phishing emails, suspicious contacts posing as compensation or refunds, and suspicious websites. GMO says it will never ask for passwords, credit card information or account information by email or phone.

For organisations that use the service, or whose suppliers do (Rescana guidance):

• Treat everything stored on an affected server as potentially exposed: API keys, broker credentials, VPN or remote access profiles, saved browser passwords and documents.
• Do not reconnect to, or restore from, a server image until GMO says it is safe. Rebuild from known-good sources instead.
• Check whether anything critical runs only on this service, and how you would keep it running during a long outage.

Indicators of Compromise

GMO has published no indicators of compromise, no description of the malicious programs and no intrusion route. JPCERT/CC, IPA and the National Cybersecurity Office have published nothing specific either. We have no IOCs to share. No source maps the incident to MITRE ATT&CK, and we have not done so either.

What we will update

We will update this post when GMO publishes a further report or a resumption date; if GMO reports findings on individual cases, on customers' devices or on the reported trading account operations; if it discloses the intrusion route or the nature of the malicious programs; if it changes the 26,739 figure or its service-site notice; or if JPCERT/CC or another national CERT publishes guidance.

Sources

GMO Internet

• First report, "[Important] Apology and Notice Regarding Unauthorized Access by a Third Party to Onamae.com Desktop Cloud (As of 4:00 JST, October 21, 2026)": https://internet.gmo/en/news/article/246/; Japanese original: https://www.onamae.com/news/article/11584/ (GMO's Japanese summary page: https://internet.gmo/news/article/246/)
• Second report, "[Important] Notice and Apology Regarding Unauthorized Access to 'Onamae.com Desktop Cloud' (Second Report)", as of 16:59 JST, 22 October 2026: https://internet.gmo/en/news/article/247/; Japanese originals: https://www.onamae.com/news/article/11593/ and https://internet.gmo/news/article/247/
• Third report, 「【重要】「お名前.com デスクトップクラウド」への不正アクセスに関するお詫びとお知らせ（第3報）」 ("[Important] Apology and Notice Regarding Unauthorized Access to 'Onamae.com Desktop Cloud' (Third Report)"), as of 16:10 JST, 23 October 2026, Japanese only (the English page carried no text as of 10:19 Cyprus time): https://internet.gmo/news/article/248/; also on onamae.com: https://www.onamae.com/news/article/11595/
• Onamae.com Desktop Cloud service site (Japanese), incident notice as updated 23 October 2026 (checked 10:19 Cyprus time): https://www.onamae-desktop.com/

National CERT and government (checked 23 October 2026, 10:20 Cyprus time; nothing incident-specific)

• JPCERT/CC: https://www.jpcert.or.jp/
• IPA: https://www.ipa.go.jp/security/ and National Cybersecurity Office: https://www.cyber.go.jp/

Why this matters for your vendors

A shared hosted-desktop platform turns one cloud provider's incident into many customers' incidents at once, and a full shutdown means those customers lose the service while their credentials may already be exposed. The questions worth asking are whether a supplier depends on this platform, and whether they had a plan for a provider going dark.

Forward this to your TPRM owner (Rescana guidance). A short, friendly check with suppliers that may use Japanese hosting:

• Do you, or any service you run for us, use Onamae.com Desktop Cloud or other GMO Internet hosting?
• If so, what was stored or running on those servers, and have you rotated the credentials and keys that were on them?
• What is your continuity plan while the service is down, and how long can you operate without it?
• Have you seen any unusual activity in accounts whose credentials were stored there?
• How do you avoid having critical operations depend on a single hosting provider?

Want a fast, evidence-based view of which suppliers depend on the same hosting providers, and where that concentration sits? Book a demo.