Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers’ servers.
The company confirmed on October 20 that an unauthorized third party installed “malicious programs” in some customer environments.
After detecting the intrusion, the company says it progressively shut down customer servers beginning at 04:00 local time on October 21, 2026.
“We have confirmed that unauthorized access by a third party occurred against Onamae.com Desktop Cloud and that unauthorized programs were installed in some customers’ server environments,” reads the announcement.
Onamae.com, operated by GMO Internet, a member of GMO Internet Group, is one of Japan’s largest domain registrars and also provides web hosting, DNS, and other internet infrastructure services.
Its Desktop Cloud byGMO service is advertised as “ideal for stable FX automated trading, including continuous operation of MetaTrader 4 (MT4).”
According to the alert, the breach may have exposed data stored on the impacted servers. However, the company has not confirmed any instance of information being misused or leaked.
The company also emphasizes that payment information, such as credit card details, is not affected because it is stored on a different infrastructure.
As the investigation continues and more details become available, GMO says it will provide updates.
The company announced a service interruption starting today at 4 a.m. (local time), noting that all Desktop Cloud plans will be impacted. No estimated date has been provided for restarting the service.
Customers who stored secrets, such as passwords, on their servers are advised to rotate them as soon as possible, as they may have been compromised.
The company also noted an increased risk of phishing emails and other unsolicited communications, as threat actors may try to exploit the incident to convince customers to disclose sensitive information.
“We will never ask you for your password or credit card information via email or phone,” the company says.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
