Japan’s Onamae Desktop Cloud Hacked, Up to 27,000 Servers Affected
The Onamae Desktop Cloud, operated by GMO Internet, a virtual private server (VPS) provider in Japan, has experienced a security breach which resulted in malicious software being installed on as many as 26,739 servers of customers. While investigating the intrusion and assessing the potential impact on customer data, the company has suspended its cloud hosting services.
The GMO Internet team confirmed the incident on October 20, stating that unauthorized third parties gained access to Onamae.com Desktop Cloud and installed malicious software in some customer environments. In response, the company began progressively shutting down affected customer servers from 4:00 a.m. local time on October 21, 2026.
All Desktop Cloud plans will be affected, but no time frame has been announced for the restoration of service.
A detailed description of how the attackers gained access, what type of malware was deployed, and whether the intrusion affected environments other than those identified as customer environments has not yet been disclosed by the company.
Customer Data Potentially Exposed
A concern has been raised regarding the confidentiality of information stored on the affected servers. According to GMO Internet, customer information held in compromised environments may have been exposed. However, to date, the company has not confirmed any instances of data theft, leakage, or misuse.
In the company's clarification, payment information, including credit card details, is not affected since it is stored on separate infrastructure. Further details are expected as the investigation progresses. It has been advised that customers who stored sensitive information on their servers, including passwords and other credentials, should change them as soon as possible.
It is possible that such information may have been accessed during the intrusion.
In addition to cautioning customers about potential phishing attempts and unsolicited communications related to this incident, GMO Internet has also warned them against fraudulent communication designed to obtain account credentials or other sensitive information during the breach.
Onamae.com emphasizes that they will not be asking for passwords or credit card information via email or telephone.
The company is one of the largest domain registration providers in Japan, offering web hosting, DNS and other internet infrastructure services as well. Desktop Cloud byGMO supports virtual server workloads, including MetaTrader 4 for automated foreign exchange trading.
Several customer-hosted environments are being scrutinized following this incident, as well as the potential consequences of unauthorized access to cloud infrastructure.
An investigation is currently underway, and it is unclear what the extent of the compromise and how it was accomplished.
Neither the company nor its subsidiary has provided technical information about the intrusion, including the malware family, initial access method, or attacker's identity. There have been no public indications of compromise, such as malicious IP addresses, domains, file hashes, or filenames, that indicate a compromised system.
The available information does not provide information about whether the attackers exploited vulnerabilities, stolen credentials, or used another technique to access the infrastructure.
This disruption may have implications beyond the immediate disruption of service, particularly for customers who use the platform to run automated foreign exchange trading software.
While the provider investigates the incident and works to restore operations, businesses and individual users may face interruptions while servers are taken offline across all plans. The company has requested that customers update their authentication details, including their account IDs and passwords, stored on the affected servers.
It is important to change passwords for other services that were reused to reduce the risk of unauthorized access if credentials were exposed during the breach.
In addition to the company's warning about phishing, cybercriminals may use the incident to send fraudulent messages masquerading as service notifications or technical support requests. Cybercriminals may also utilize the incident to conduct follow-on attacks.
It is recommended that customers verify communications through official channels and not share login information when responding to unsolicited requests for the time being.
The full extent of the incident remains unclear at this time, although 26,739 servers have been identified as potentially infected, but this figure does not indicate that every server has been infected.
There have been no confirmed instances of customer information being leaked or misused by the company. As part of the investigation, it is anticipated that details will be disclosed regarding how the attackers entered the environment, what malicious programs were intended to accomplish,
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: