What Onamae.com and GMO Internet confirmed
Onamae.com, operated by GMO Internet and part of GMO Internet Group, said an unauthorized third party installed “malicious programs” in some customer environments of its Desktop Cloud service. The company confirmed the intrusion on October 20 and said it detected the compromise before taking progressive containment actions.
GMO emphasised that payment information such as credit card details is not affected because those records are stored on a different infrastructure. The company also said it has not confirmed any instance of information being misused or leaked, even as the investigation continues.
Scope: up to 26,739 customer servers impacted
GMO reported that hackers installed malware on as many as 26,739 customers’ servers. The alert warned that data stored on the impacted servers may have been exposed, and advised customers who kept secrets—such as passwords—on their servers to rotate them immediately because those credentials may have been compromised.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildService interruption and timeline
After detecting the intrusion, Onamae.com progressively shut down customer servers beginning at 04:00 local time on October 21, 2026. The company announced a service interruption starting at 4 a.m., stating that all Desktop Cloud plans will be affected. No estimated date has been provided for when the service will restart.
Customer guidance and phishing risk
GMO warned customers to expect an increased risk of phishing emails and other unsolicited communications, saying threat actors may try to exploit the incident to convince customers to disclose sensitive information. The company stated plainly: “We will never ask you for your password or credit card information via email or phone.”
Desktop Cloud users, automated trading, and exposed use cases
Desktop Cloud byGMO is promoted as “ideal for stable FX automated trading, including continuous operation of MetaTrader 4 (MT4).” That positioning highlights a class of users—those operating continuous trading platforms and other always-on workloads—who could be particularly exposed when provider infrastructure is compromised and service is halted.
What this means for security teams, customers, and regulators
- Security teams and technologists: The alert and GMO’s advice to rotate server-stored secrets underscore a common post-compromise priority—credential rotation and containment of unauthorized programs. The company’s shutdown of affected servers beginning at 04:00 local time on October 21, 2026 reflects containment in progress while an investigation continues.
- Desktop Cloud customers and enterprises running continuous services: Customers should follow the company’s guidance to change passwords and be vigilant for phishing attempts. The fact that payment data is segregated and reported as unaffected may reduce some financial exposure, but data stored on impacted servers remains a concern.
- Regulators and procurement leaders: The incident draws attention to suppliers that host always-on trading and operational workloads; service outages and the potential for data exposure are likely to be central questions as GMO’s investigation proceeds and as affected customers assess contractual and regulatory obligations.
GMO said it will provide updates as the investigation continues. The company noted the risk profile of post-compromise activity: “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.” The Blue Report 2026, cited in the alert, measures defenses technique by technique across 338 million simulations run in customer production environments.
The record of what occurred is precise on a few points: malicious programs were installed, up to 26,739 servers may be affected, payment systems are kept separate, and customers should rotate secrets and watch for phishing. What remains to be seen—how broadly data was exfiltrated, how long attackers had access, and when Desktop Cloud service will resume—will depend on GMO’s continuing investigation and the updates it provides.
