Check Onamae.com Cloud Accounts After Hackers Install Malware on 26,000 Servers

Users of Onamae.com Desktop Cloud face potential exposure of their stored data after hackers installed malicious programs on customer servers. The Japanese provider, operated by GMO Internet, confirmed the breach on October 20, 2026. The incident has forced a complete suspension of services across all plans to prevent further unauthorized access.

Who is affected by this cloud server breach?

GMO Internet identified 26,739 potentially affected servers within its Onamae.com Desktop Cloud environment. This figure represents the total number of systems that might have been compromised, rather than a confirmed count of individual malware infections or unique customers. The company stated that malicious programs were found on only some customer environments, leaving the exact scope of the intrusion unclear.

The service is frequently used to operate automated foreign exchange trading software. This usage pattern creates a direct link between the infrastructure failure and the potential exposure of sensitive trading credentials. Consequently, users running financial automation tools on these virtual servers are at particular risk of having their access details viewed by third parties.

What data might have been exposed?

The provider warned that information stored on the affected systems may have been viewed by the attackers. While Onamae.com stated it has not confirmed the leakage of personal information entrusted to the company, this assurance does not guarantee that data inside the customer-controlled servers remained inaccessible. The company also noted it does not retain payment information, such as credit card details, which were therefore not part of the breach.

OANDA Japan issued a separate warning on October 22, 2026, advising customers that login IDs and passwords used with MetaTrader 4 and MetaTrader 5 platforms on the Desktop Cloud may have been viewed. This specific alert highlights the risk to financial account credentials stored within the compromised virtual environments.

Why are services suspended and when will they return?

GMO Internet announced rolling server shutdowns beginning at 4:00 a.m. Japan time on October 21, 2026. The suspension was implemented to prevent further damage while investigators examined the customer environments for signs of compromise. The company has not provided a confirmed date for restoring services, meaning users should expect prolonged downtime while security teams assess the extent of the intrusion.

What details are missing from the incident report?

The incident notice does not identify the specific type of malware, the initial access vector, or the vulnerabilities exploited by the attackers. It also lacks information on persistence mechanisms or attacker infrastructure. Furthermore, the disclosure provides no technical indicators, such as file hashes or malicious domains, which customers could use for independent threat hunting on their own systems.

This lack of detail means it is unclear whether attackers compromised a centralized management component, individual virtual servers, or another part of the service. The company also offered no basis for attributing the intrusion to a specific threat actor or classifying the malicious programs as ransomware, credential stealers, or cryptominers.

What affected people can do

Users should immediately check whether they stored sensitive credentials or financial data on Onamae.com Desktop Cloud servers. If you use automated trading platforms, assume your login details may be compromised and change them on the broker’s website directly. Monitor your financial accounts for unauthorised transactions. Be vigilant for follow-up scams, as attackers often exploit recent breaches to send phishing emails pretending to be the vendor. Do not click links in unsolicited messages claiming to offer account recovery or security updates.

Background: Unauthorized access

The difference between authorized and unauthorized access lies in explicit permission. Authorized access occurs when a system grants entry based on verified identity and defined scope. Unauthorized access happens when an entity enters or acts without this consent, whether through stolen credentials or by exceeding their granted privileges.

Read the full guide: Difference Between Authorized and Unauthorized Access: The Hidden Boundaries

What to do and how to stay safe: Onamae.com

• Change passwords for any accounts accessed via Onamae.com Desktop Cloud, especially financial and trading platforms.
• Enable multi-factor authentication on all critical accounts to add an extra layer of security.
• Review account activity logs on your broker or service provider for any unusual login attempts or transactions.
• Wait for official updates from GMO Internet before attempting to restore data from the affected cloud servers.

Step-by-step guide: Is It Safe to Use Password Managers? The Real Risks and Rewards

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did hackers steal credit card information from Onamae.com?

No, Onamae.com stated it does not retain payment information, including credit card details, so these were not part of the breach.

How many servers were potentially affected by the malware?

The company identified 26,739 potentially affected servers, though this number represents systems that might have been compromised rather than confirmed infections.

Will Onamae.com Desktop Cloud services be restored soon?

There is no confirmed restoration date yet, as the provider has suspended all services to investigate the extent of the intrusion.