● Covered by 3 sources · 4 reportsMedium impact3 negative1 neutral
Onamae Desktop Cloud Hacked, Up to 27,000 Customer Servers Affected
Key points
- Onamae Desktop Cloud infrastructure compromised.
- Malware installed on up to 26,739 customer servers.
- Servers shut down starting October 21, 2026.
- Customers advised to rotate passwords and be wary of phishing.
- GMO Internet is investigating a data leak from its Onamae cloud desktop service.
- The service provides virtualized desktops to financial traders.
- An attacker published customer and business information.
- Customers reported unauthorized operations on trading accounts.
- The company's cybersecurity unit found evidence of Artex tool use in other hacks.
- GMO Group urged customers to disconnect systems from the internet.
- No ransomware was activated on customer systems.
- Payment information was not exposed.
- MetaTrader 4 and MetaTrader 5 credentials may have been exposed.
- GMO Internet Group offers $1 million bounty for information leading to arrest of hackers.
- Reward program opened on October 28.
- GMO refused a $50 million extortion demand.
- Attackers posted material on their website on October 27.
- Attacker's website was shut down on October 28.
- The reward program is called GMO Cybercrime Bounty.
Infrastructure Compromise Confirmed
Onamae Desktop Cloud, a VPS service provider in Japan operated by GMO Internet, confirmed on October 20 that an unauthorized third party installed "malicious programs" within some customer environments. This breach affected up to 26,739 customer servers.
Service Interruption and Data Exposure
Following the detection of the intrusion, Onamae Desktop Cloud began shutting down customer servers at 04:00 local time on October 21, 2026. The company stated that data stored on the impacted servers may have been exposed, but has not confirmed any misuse or leakage of information. Payment details like credit card information are stored on separate infrastructure and were not affected.
Customer Advisories and Ongoing Investigation
Customers who stored sensitive information, such as passwords, on their servers are advised to change them immediately. The company also warned of an increased risk of phishing attempts and other unsolicited communications, urging customers to be cautious. Onamae Desktop Cloud will provide updates as its investigation continues, and an estimated date for service restoration has not been provided.
Updates
- GMO Group urged customers to disconnect systems from the internet.
- No ransomware was activated on customer systems.
- Payment information was not exposed.
- MetaTrader 4 and MetaTrader 5 credentials may have been exposed.
- GMO Internet Group offers $1 million bounty for information leading to arrest of hackers.
- Reward program opened on October 28.
- GMO refused a $50 million extortion demand.
- Attackers posted material on their website on October 27.
- Attacker's website was shut down on October 28.
- The reward program is called GMO Cybercrime Bounty.
- GMO Internet is investigating a data leak from its Onamae cloud desktop service.
- The service provides virtualized desktops to financial traders.
- An attacker published customer and business information.
- Customers reported unauthorized operations on trading accounts.
- The company's cybersecurity unit found evidence of Artex tool use in other hacks.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Japan's GMO Internet Group is offering a $1 million bounty for information leading to the arrest of hackers who breached its Onamae.com Desktop Cloud service. The service, used for FX trading, experienced a data leak that led to unauthorized trades on customer accounts, and GMO refused a $50 million extortion demand.
GMO Group advised customers to disconnect and shut down PCs due to a ransomware threat following a breach of its Onamae Desktop Cloud. The company confirmed that customer and company data was published online, but no ransomware was activated on customer systems.
Japanese internet company GMO Internet is investigating a data leak from its Onamae cloud desktop service, which provides virtualized desktops to financial traders, after suspected unauthorized access. The company believes an attacker published customer and business information, affecting up to 27,000 servers, and has advised customers to reset passwords due to reports of unauthorized operations on trading accounts.
Onamae Desktop Cloud, a Japanese VPS provider, confirmed that hackers installed malware on up to 26,739 customer servers. The company shut down affected servers and advised customers to rotate credentials due to potential data exposure, though no misuse of information has been confirmed.