Onamae Desktop Cloud shuts all servers after intrusion on 26,739

Onamae Desktop Cloud shuts all servers after intrusion on 26,739

21 October 2026: The operator of Onamae.com Desktop Cloud, a hosted Windows desktop service in Japan, says intruders planted malicious programs on some customers' servers and that up to 26,739 servers may be affected. It is shutting down the servers of every plan, in sequence from 04:00 on 21 October, with no restart date, and warns that information stored on the servers may have been viewed.

Not yet independently verified. The operator has not said how the intruders got in or what the programs do; it reports no confirmed leak of personal data so far. We will update this when it can be confirmed, and remove this note.

What the operator has confirmed

The unauthorised access was confirmed on 20 October. The notice, published the next morning, says the company has found no leak of the personal data it holds for customers and no misuse of information viewed on the servers so far, and that it does not keep payment data such as card numbers. The investigation of customer servers continues and the company promises further notices as it learns more. BleepingComputer, reporting the incident, identifies the operator as GMO Internet Group and notes that the service is marketed for running automated foreign exchange trading with MetaTrader 4.

What customers are asked to do

Customers are asked to change the passwords and other credentials that were stored on, or used from, their servers, and any accounts where the same password was reused. The company warns of phishing that exploits the incident and says it will never ask for passwords or card details by email or phone. It has set up a contact form and a phone line, 03-5456-2560, open on weekdays from 10:00 to 18:00.

Why a forced shutdown matters to businesses

A hosted desktop running trading software is often doing work unattended, so a shutdown with no restart date stops whatever ran on it: trading strategies, scheduled jobs, remote access for staff. Anything credential-bearing that lived on those desktops, such as broker logins, API keys, saved browser passwords and remote-access tools, should be treated as exposed, whether or not a given server turns out to be among those touched. For businesses choosing a provider, the episode is a reminder to ask how a host isolates customer servers from each other and from its own management plane, and what its plan is for keeping customers running if it has to switch everything off at once.

Sources

• Onamae.com: [Onamae.com Desktop Cloud] Apology and notice regarding unauthorised access by a third party (as of 21 October 2026, 4:00), 21 October 2026
• BleepingComputer: Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected, 21 October 2026