GMO Onamae.com Desktop Cloud breach: 26,739 servers potentially affected; PC advice revised
GMO’s Onamae.com Desktop Cloud breach affects customers using hosted desktops, including FX traders. GMO revised its shutdown advice on 28 October: scan and back up before reusing PCs, reset trading passwords from another device and end all sessions.
If you use Onamae.com Desktop Cloud, check GMO’s official notices: its 28 October update asks you to run a security scan and back up before using your PC again. From a separate device not used for FX trading, change trading-account passwords, ask your broker to end all sessions, check transactions and balances, and enable two-factor authentication where available. Avoid alleged leaked-data sites and anyone asking for payment to recover losses.
What’s happening
GMO Internet discovered unauthorised programs on some Onamae.com Desktop Cloud customer servers on 20 October, with 26,739 servers potentially affected. The hosted desktop service is used for foreign exchange trading. GMO began shutting down servers across all plans on 21 October and later told customers to protect trading accounts and end existing sessions. A subsequent threat to publish information and launch ransomware prompted advice to back up, disconnect and shut down customers’ own PCs. On 27 October, GMO confirmed publication of alleged company and customer information but said it was still verifying the contents. Its 28 October update reported no malware or ransomware traces on the customer devices examined so far and asked customers to scan and back up before reusing PCs. Those findings were limited to examined devices; investigation continued.
- What
- Breach
- Affects
- GMO Onamae.com Desktop Cloud
- Fixed in
- Nothing to patch
- Since
- 20 Oct 2026
Timeline
- Vendor revised
GMO reported no malware infection or ransomware traces on the customer devices examined so far, with investigation continuing. It revised its PC advice to request a security scan and backup before using the computers again.
- Update
GMO said the domain hosting alleged customer information had been suspended at about 04:00 JST. It continued to warn against visiting or spreading the material.
- Update
GMO said suspected attackers had published alleged company and customer information, whose contents it was verifying. No ransomware attack had been confirmed as of 13:55 JST.
- Update
After receiving a threat of ransomware and information publication at noon JST, GMO asked customers to scan and back up their PCs, disconnect the network, shut down and unplug connected cables.
- Update
GMO instructed customers to change trading passwords from a separate device and disconnect every trading session, including sessions that might survive a password change. It also asked customers to check balances and trading histories.
- Made public
GMO published its first notice at 04:00 JST on 21 October and began shutting down customer servers across all Desktop Cloud plans.
- UpdateNothing to patch
GMO confirmed unauthorised programs on some Onamae.com Desktop Cloud customer servers. It identified 26,739 servers as potentially affected.
Sources
- Unauthorised access to Onamae.com Desktop Cloud — first reportGMO Internet · 21 Oct 2026
- Requests to Onamae.com Desktop Cloud customers — fifth reportGMO Internet · 24 Oct 2026
- Current response to unauthorised access — eighth reportGMO Internet Group · 27 Oct 2026
- Current Response to Unauthorized Access to Onamae.com Desktop Cloud — Tenth ReportGMO Internet · 27 Oct 2026
- Current response to unauthorised access — thirteenth reportGMO Internet · 28 Oct 2026
- Current response to unauthorised access — fourteenth reportGMO Internet · 28 Oct 2026
- Japan's GMO urges customers to shut down PCs amid ransomware threatBleepingComputer · 27 Oct 2026
- Japan internet giant GMO says hackers posted stolen customer dataTechCrunch · 27 Oct 2026