/
← Voltar ao feed
high technology hosting financial services

Onamae Desktop Cloud (GMO Internet) breached; malware installed on up to 26,739 customer VPS servers

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 18:43 · coletado há 1 dia

Hackers compromised the infrastructure of Onamae.com Desktop Cloud, a VPS service operated by GMO Internet in Japan, and installed malicious programs on up to 26,739 customer servers. The company confirmed the intrusion on October 20, 2026. It began progressively shutting down customer servers at 04:00 local time on October 21, and all Desktop Cloud plans are affected. The data stored on the impacted servers may have been exposed, but GMO has not confirmed any misuse or leak. Payment data such as credit card details is stored on separate infrastructure and is reportedly unaffected. The service is marketed for FX automated trading with MetaTrader 4 (MT4).

Detalhes técnicos

  • An unauthorized third party gained access to Desktop Cloud infrastructure and installed "unauthorized programs" in some customers' server environments.
  • The article gives no initial access vector, malware family, attribution or IOCs.
  • GMO warns of an increased risk of phishing and other unsolicited communications that exploit the incident.

Remediação

  • Rotate passwords and other secrets that were stored on Desktop Cloud servers as soon as possible.
  • Treat emails or calls asking for passwords or credit card details as suspicious. GMO says it will never request them by email or phone.
  • No restart date for the service has been given. GMO says it will publish updates as the investigation continues.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 21/10/2026 18:43 · coletado 21/10 20:00 primeiro registro

    Onamae Desktop Cloud (GMO Internet) breached; malware installed on up to 26,739 customer VPS servers

    ler a análise desta fonte

    Hackers compromised the infrastructure of Onamae.com Desktop Cloud, a VPS service operated by GMO Internet in Japan, and installed malicious programs on up to 26,739 customer servers. The company confirmed the intrusion on October 20, 2026. It began progressively shutting down customer servers at 04:00 local time on October 21, and all Desktop Cloud plans are affected. The data stored on the impacted servers may have been exposed, but GMO has not confirmed any misuse or leak. Payment data such as credit card details is stored on separate infrastructure and is reportedly unaffected. The service is marketed for FX automated trading with MetaTrader 4 (MT4).

    Technical Details

    • An unauthorized third party gained access to Desktop Cloud infrastructure and installed "unauthorized programs" in some customers' server environments.
    • The article gives no initial access vector, malware family, attribution or IOCs.
    • GMO warns of an increased risk of phishing and other unsolicited communications that exploit the incident.

    Remediation

    • Rotate passwords and other secrets that were stored on Desktop Cloud servers as soon as possible.
    • Treat emails or calls asking for passwords or credit card details as suspicious. GMO says it will never request them by email or phone.
    • No restart date for the service has been given. GMO says it will publish updates as the investigation continues.