Onamae Desktop Cloud shuts all servers after intrusion on 26,739

Onamae Desktop Cloud shuts all servers after intrusion on 26,739

21 October 2026: The operator of Onamae.com Desktop Cloud, a hosted Windows desktop service in Japan, says intruders planted malicious programs on some customers' servers and that up to 26,739 servers may be affected. It is shutting down the servers of every plan, in sequence from 04:00 on 21 October, with no restart date, and warns that information stored on the servers may have been viewed.

Not yet independently verified. The 21 October figures and timeline are the operator's own. Its fourth notice of 24 October later confirmed that customer information was taken, which replaces the no-leak statement in our first report. We will update this when it can be confirmed, and remove this note.

Update, 10 November 2026: The operator's fourth notice, dated 24 October, says its investigation confirmed that customer information was carried out of the service, and that some customers report trades on their brokerage accounts that they did not make. It offers 5,000 yen to every current customer, six months free on a replacement service and cover for losses from unauthorised trades. Our follow-up report has the details.

What the operator has confirmed

The unauthorised access was confirmed on 20 October. The first notice, published the next morning, said the company had found no leak of the personal data it holds for customers and no misuse of information viewed on the servers, and that it does not keep payment data such as card numbers. The later finding in the update above replaces that statement. BleepingComputer, reporting the incident, identifies the operator as GMO Internet Group and notes that the service is marketed for running automated foreign exchange trading with MetaTrader 4.

What customers are asked to do

Customers are asked to change the passwords and other credentials that were stored on, or used from, their servers, and any accounts where the same password was reused. The company warns of phishing that exploits the incident and says it will never ask for passwords or card details by email or phone. It has set up a contact form and a phone line, 03-5456-2560, open on weekdays from 10:00 to 18:00.

Why a forced shutdown matters to businesses

A hosted desktop running trading software is often doing work unattended, so a shutdown with no restart date stops whatever ran on it: trading strategies, scheduled jobs, remote access for staff. Anything credential-bearing that lived on those desktops, such as broker logins, API keys, saved browser passwords and remote-access tools, should be treated as exposed, whether or not a given server turns out to be among those touched. For businesses choosing a provider, the episode is a reminder to ask how a host isolates customer servers from each other and from its own management plane, and what its plan is for keeping customers running if it has to switch everything off at once.

Sources

• Onamae.com: [Onamae.com Desktop Cloud] Apology and notice regarding unauthorised access by a third party (as of 21 October 2026, 4:00), 21 October 2026
• BleepingComputer: Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected, 21 October 2026
• Onamae.com: fourth report on the unauthorised access (Japanese), 24 October 2026