Cloud Security · Incident Response
Hackers install malware on up to 27,000 Onamae Desktop Cloud servers
Hackers breached Onamae Desktop Cloud in Japan, installing malware on up to 27,000 customer servers. Customers are advised to change passwords and watch for phishing attempts.
Ross Grant2 min read
The short version
Hackers broke into Onamae Desktop Cloud, a popular server service in Japan, and installed malware on thousands of customer servers. The company shut down affected servers and warned users that their data could be at risk. Payment details were not affected, but customers should change any passwords they stored on their servers. There is also a higher risk of scam emails pretending to be from Onamae.
By the numbers
- 26,739customer servers potentially affectedBleepingComputer
- 4:00 a.m. 21 Oct 2026time service shutdown beganBleepingComputer
What happened?
Hackers breached Onamae Desktop Cloud, a major Japanese VPS provider, and installed malware on up to 26,739 customer servers. The company confirmed the incident on 20 October 2026 and began shutting down affected servers the next day. Data stored on these servers may have been exposed, but payment information is not affected. Customers are being advised to change passwords and watch for phishing attempts.
Who is affected
Onamae Desktop Cloud, a major provider of virtual private servers (VPS) in Japan, has confirmed that up to 26,739 customer servers may have been compromised. The service is widely used for automated trading platforms such as MetaTrader 4 (MT4), and is operated by GMO Internet, one of Japan’s largest domain registrars. All Desktop Cloud plans are affected by the incident, according to the company’s announcement.
How the attack worked
According to BleepingComputer (opens in a new tab), attackers gained unauthorised access to Onamae Desktop Cloud’s infrastructure and installed malicious programs (malware) on customer servers. The company detected the intrusion and began shutting down affected servers at 4:00 a.m. local time on 21 October 2026. The exact method used by the attackers to breach the infrastructure has not been disclosed.
What was taken
The company says that data stored on the impacted servers may have been exposed. However, there is no confirmation yet of any information being misused or leaked. Payment information, such as credit card details, is not affected because it is kept on separate infrastructure. Customers who stored secrets, such as passwords, on their servers are being advised to rotate them immediately, as these could have been compromised.
The response
Onamae Desktop Cloud has shut down all affected servers and announced a service interruption for all Desktop Cloud plans. There is no estimated date for when services will resume. The company is continuing its investigation and will provide updates as more information becomes available. Customers are also being warned about an increased risk of phishing emails and other scams that may try to exploit the situation. Onamae has stressed that it will never ask for passwords or credit card information by email or phone.
What you should do
Customers should change any passwords or secrets that were stored on their servers as soon as possible. Be cautious of unsolicited emails or phone calls claiming to be from Onamae, especially those asking for sensitive information. If you receive such a request, do not respond and report it to the company directly.
Why it matters
This attack affects a large number of servers used for trading and other critical tasks. Customers could face data theft or further attacks if they do not act quickly. The incident highlights the risks of storing secrets on cloud servers.
Key points
- Up to 26,739 Onamae Desktop Cloud servers were compromised with malware.
- Data stored on affected servers may have been exposed, but payment information is safe.
- Customers should change passwords and be alert for phishing attempts.
- All Desktop Cloud plans are impacted, with no timeline for service restoration.
- The company is continuing its investigation and will provide updates.
Sources
BleepingComputer
Reference
