Summary
- Environment: Onamae.com Desktop Cloud customer servers and trading tools
- Operational impact: All plans suspended; 26,739 servers potentially affected
- Financial impact: Customer reports of unauthorized trades; no quantified loss total
- Record status: Developing record. Reviewed October 22, 2026; updated as evidence emerges.
What happened
GMO Internet confirmed malicious programs on some Onamae.com Desktop Cloud servers on October 20, 2026. Its first notice identified 26,739 servers as potentially affected. This was not a confirmed infection or affected-person count. [2]
The October 22 follow-up reported customer complaints about unauthorized trading-account operations. GMO said stored account credentials may have been obtained and misused. [1]
Impact
All Desktop Cloud plans were progressively stopped from October 21 at 04:00 Japan time. The first notice said information on the servers might have been viewed, without confirmed misuse at that point. [2]
The later trading-account reports changed that assessment. GMO said payment-card information was not stored on these service servers; the investigation’s full scope remained unresolved. [1]
Timeline
Investigation began
A customer inquiry prompted investigation.
[1]Malicious programs confirmed
New signups and the control panel were stopped.
[1]All-plan shutdown began
GMO began stopping servers and published its first notice.
[2]Trading-account warning expanded
GMO issued its second notice and consulted police.
[1]Briefing updated
This briefing was last reviewed and updated on October 22, 2026.
Threat Group & Attack Vector
The server intrusion and malicious programs were confirmed. How the attackers entered remained under investigation with security specialists. Stored credentials for tools such as MT4/MT5 were potentially exposed. [1][2]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
GMO advised changing trading credentials from another device, disconnecting sessions, reviewing transactions and enabling available two-step authentication. All-plan suspension continued without a confirmed restart date. [1]