Security breach details
Onamae.com, a subsidiary of the Japanese GMO Internet group, has announced that its Desktop Cloud service infrastructure has been subjected to a large-scale security breach. The company confirmed on October 20, 2026, that an unauthorized third party managed to access customer work environments and install malware, affecting approximately 26,739 virtual servers.
In response to this threat, the company began shutting down customer servers gradually on October 21, 2026, at 04:00 AM local time to prevent the spread of malware or further damage. The company has not yet specified a date for resuming the service.
What does this mean for users?
This breach is particularly sensitive due to the nature of the service's usage, as Desktop Cloud servers are widely used for automated foreign exchange (FX) trading operations that require continuous operation of platforms such as MetaTrader 4. The implications for users include the following:
- Data leakage risk: The company warned of the possibility that data stored on the affected servers may have been compromised, although there is no official confirmation of an actual leak yet.
- Credential changes: The company advises all customers to immediately change passwords and all secrets stored on the servers as a precautionary measure.
- Phishing threats: The company warned of an increased risk of receiving fraudulent emails or communications that exploit this incident to attempt to steal sensitive data, emphasizing that it will never ask for passwords or credit card details via phone or email.
The company's position on financial data
The company reassured its customers that payment data, such as credit card details, was not affected by this breach, as this information is stored on infrastructure completely separate from the virtual server environment that was attacked. The company continues its technical investigations into the incident, with a promise to provide periodic updates to customers regarding the developments of the situation.