Onamae Desktop Cloud hacked, malware planted on up to 27,000 customer servers

On 20 October 2026, Onamae Desktop Cloud — a Japanese virtual private server (VPS) service operated by Onamae.com, the domain registrar and hosting arm of GMO Internet Group — confirmed that an unauthorized third party had installed malicious programs inside some customers' server environments. The service is marketed for running automated foreign-exchange trading bots around the clock, including MetaTrader 4 instances, so many affected machines were left running unattended.

After detecting the intrusion, the company began progressively shutting down customer servers at 04:00 local time on 21 October 2026 and suspended every Desktop Cloud plan, warning that there was no estimated time for service to resume. According to reporting, as many as 26,739 customer servers were affected by the shutdown.

What was exposed

The company said data stored on the affected servers may have been exposed, but it had not confirmed any misuse or leak. Payment details such as credit card numbers were reportedly held on separate infrastructure and were not affected. Onamae urged any customer who had stored passwords, API keys, or other secrets on a Desktop Cloud server to rotate them as soon as possible, and cautioned that it would never ask for a password or card details by email or phone — a warning aimed at the phishing that typically follows an incident of this scale.

A provider compromise cascading to tenants

The intrusion sits in the uncomfortable middle ground of hosting security: an attacker who reaches a provider's control plane can plant code directly on the virtual machines its customers rely on, turning a single platform compromise into malware on thousands of downstream systems. GMO had not disclosed how the attackers gained access, named any threat actor, or set a recovery timeline, and said it would provide further updates as its investigation continued.