--- title: "Onamae.com Desktop Cloud server compromise" description: "Onamae.com Desktop Cloud suspended all plans after malware was found; customers later reported unauthorized trading-account operations." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-22" canonical_url: "https://www.ally.security/incidents/onamae-desktop-cloud-server-compromise-2026" markdown_url: "https://www.ally.security/incidents/onamae-desktop-cloud-server-compromise-2026.md" stix_url: "https://www.ally.security/incidents/onamae-desktop-cloud-server-compromise-2026/stix.json" --- # Onamae.com Desktop Cloud server compromise GMO identified malicious programs on customer servers and later warned that stored trading credentials may have been misused. Last modified Oct 22, 2026 · 2 sources ## Summary - **Environment:** Onamae.com Desktop Cloud customer servers and trading tools - **Operational impact:** All plans suspended; 26,739 servers potentially affected - **Financial impact:** Customer reports of unauthorized trades; no quantified loss total ## What happened [GMO Internet](https://internet.gmo/) confirmed malicious programs on some [Onamae.com Desktop Cloud](https://www.onamae-desktop.com/) servers on October 20, 2026. Its [first notice](https://www.onamae.com/news/article/11584) identified 26,739 servers as potentially affected. This was not a confirmed infection or affected-person count. [2](#source-2) The [October 22 follow-up](https://www.onamae.com/news/article/11593) reported customer complaints about unauthorized trading-account operations. GMO said stored account credentials may have been obtained and misused. [1](#source-1) ## Impact All Desktop Cloud plans were progressively stopped from October 21 at 04:00 Japan time. The first notice said information on the servers might have been viewed, without confirmed misuse at that point. [2](#source-2) The later trading-account reports changed that assessment. GMO said payment-card information was not stored on these service servers; the investigation’s full scope remained unresolved. [1](#source-1) ## Timeline ### October 19, 2026 — Investigation began A customer inquiry prompted investigation. [1](#source-1) ### October 20, 2026 — Malicious programs confirmed New signups and the control panel were stopped. [1](#source-1) ### October 21, 2026 — All-plan shutdown began GMO began stopping servers and published its [first notice](https://www.onamae.com/news/article/11584). [2](#source-2) ### October 22, 2026 — Trading-account warning expanded GMO issued its [second notice](https://www.onamae.com/news/article/11593) and consulted police. [1](#source-1) ### October 22, 2026 — Briefing updated This briefing was last reviewed and updated on October 22, 2026. ## Threat Group & Attack Vector The server intrusion and malicious programs were confirmed. How the attackers entered remained under investigation with security specialists. Stored credentials for tools such as MT4/MT5 were potentially exposed. [1](#source-1) [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response GMO advised changing trading credentials from another device, disconnecting sessions, reviewing transactions and enabling available two-step authentication. All-plan suspension continued without a confirmed restart date. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### お名前.com デスクトップクラウド: 不正アクセスに関するお詫びとお知らせ（第2報） official · GMO Internet · Oct 22, 2026 ### お名前.com デスクトップクラウド: 第三者による不正アクセス（2026年10月21日4:00時点） official · GMO Internet · Oct 21, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Onamae.com Desktop Cloud server compromise: All-plan shutdown and first notice 2. **Resulted In · 100% confidence · current** Onamae.com Desktop Cloud server compromise: GMO was investigating the intrusion route and scope with security specialists and coordinating with relevant providers. 3. **Discovered At · 100% confidence · current** Onamae.com Desktop Cloud server compromise: 2026-10-20 4. **Occurred At · 100% confidence · current** Investigation started after customer inquiry: 2026-10-19 5. **Resulted In · 100% confidence · current** Onamae.com Desktop Cloud server compromise: By October 22, GMO had received customer reports of unauthorized trading-account operations and said stored trading credentials may have been obtained and misused; the full scope remained under investigation. 6. **Occurred At · 100% confidence · current** Malware confirmed; signups and control panel stopped: 2026-10-20 7. **Resulted In · 100% confidence · current** Onamae.com Desktop Cloud server compromise: The October 21 notice said no misuse or personal-information leakage had been confirmed at that point. 8. **Resulted In · 100% confidence · current** Onamae.com Desktop Cloud server compromise: Investigation started after customer inquiry 9. **Resulted In · 100% confidence · current** Onamae.com Desktop Cloud server compromise: GMO said payment information, including card details, was not held on this service’s servers. 10. **Resulted In · 100% confidence · current** Onamae.com Desktop Cloud server compromise: Malware confirmed; signups and control panel stopped 11. **Affected Organization · 100% confidence · current** Onamae.com Desktop Cloud server compromise: GMO Internet, Inc. 12. **Occurred At · 100% confidence · current** Trading-account warning and police consultation: 2026-10-22 13. **Resulted In · 100% confidence · current** Onamae.com Desktop Cloud server compromise: GMO asked users to change trading-tool and trading-account credentials from another device, disconnect sessions, inspect balances and transactions, and enable available two-step authentication. 14. **Occurred At · 100% confidence · current** All-plan shutdown and first notice: 2026-10-21 15. **Resulted In · 100% confidence · current** Onamae.com Desktop Cloud server compromise: GMO stopped all Desktop Cloud plans in stages from October 21 at 04:00 Japan time; the October 22 notice said suspension continued with no restart date. 16. **Resulted In · 100% confidence · current** Onamae.com Desktop Cloud server compromise: Trading-account warning and police consultation 17. **Resulted In · 100% confidence · current** Onamae.com Desktop Cloud server compromise: GMO confirmed unauthorized programs in some Onamae.com Desktop Cloud customer server environments on October 20; 26,739 servers were potentially affected. 18. **Disclosed At · 100% confidence · current** Onamae.com Desktop Cloud server compromise: 2026-10-21