Malware planted on Onamae.com Desktop Cloud servers; 26,739 servers potentially affected, all plans suspended
Attackers gained unauthorized access to Onamae.com Desktop Cloud, operated by GMO Internet, and installed malicious programs in some customer server environments. GMO confirmed the installations on October 20, 2026. On October 21 it began rolling shutdowns of all Desktop Cloud plans and identified 26,739 potentially affected servers. Information on those servers may have been viewed. Because Desktop Cloud is commonly used to run automated forex trading software, OANDA Japan warned on October 22 that MetaTrader 4/5 login credentials hosted there may have been exposed.
Detalhes técnicos
- The notice does not name the malware, initial access vector, exploited vulnerabilities, persistence mechanisms or attacker infrastructure, and it publishes no IOCs.
- It is unclear whether a central management component, individual virtual servers or another part of the service was compromised.
- The 26,739 figure counts potentially affected servers, not verified infections or customers.
- There is no attribution, and the malware type (ransomware, stealer or cryptominer) is not established.
- GMO says it has not confirmed leakage of customer personal information or misuse of viewed data, and that it does not retain payment card data. This does not show that data inside affected customer servers stayed inaccessible.
- Other Onamae.com services have not been announced as suspended.
Remediação
- Immediately change all credentials stored on or used by Desktop Cloud servers, and change any reused passwords on other services.
- OANDA Japan customers should change My Page and MT4/MT5 passwords, enable two-factor authentication where available, review trading histories and report suspicious transactions to support.
- Watch for phishing that exploits the incident. GMO says staff never ask for passwords or card data by email or phone.
- Wait for GMO's further findings and its service resumption announcement.
Linha do tempo
-
Malware planted on Onamae.com Desktop Cloud servers; 26,739 servers potentially affected, all plans suspended
ler a análise desta fonte ocultar
Attackers gained unauthorized access to Onamae.com Desktop Cloud, operated by GMO Internet, and installed malicious programs in some customer server environments. GMO confirmed the installations on October 20, 2026. On October 21 it began rolling shutdowns of all Desktop Cloud plans and identified 26,739 potentially affected servers. Information on those servers may have been viewed. Because Desktop Cloud is commonly used to run automated forex trading software, OANDA Japan warned on October 22 that MetaTrader 4/5 login credentials hosted there may have been exposed.
Technical Details
- The notice does not name the malware, initial access vector, exploited vulnerabilities, persistence mechanisms or attacker infrastructure, and it publishes no IOCs.
- It is unclear whether a central management component, individual virtual servers or another part of the service was compromised.
- The 26,739 figure counts potentially affected servers, not verified infections or customers.
- There is no attribution, and the malware type (ransomware, stealer or cryptominer) is not established.
- GMO says it has not confirmed leakage of customer personal information or misuse of viewed data, and that it does not retain payment card data. This does not show that data inside affected customer servers stayed inaccessible.
- Other Onamae.com services have not been announced as suspended.
Remediation
- Immediately change all credentials stored on or used by Desktop Cloud servers, and change any reused passwords on other services.
- OANDA Japan customers should change My Page and MT4/MT5 passwords, enable two-factor authentication where available, review trading histories and report suspicious transactions to support.
- Watch for phishing that exploits the incident. GMO says staff never ask for passwords or card data by email or phone.
- Wait for GMO's further findings and its service resumption announcement.