GMO Onamae Desktop Cloud Breach: Up to 26,739 Servers Hit and What IT Teams Should Do

The incident is a reminder that managed virtual desktops and VPS platforms hold credentials, API keys and trading or admin sessions that attackers can reuse elsewhere. Here is what has been reported, why it matters and what IT teams should do.

What happened and when

GMO Internet, which operates Onamae.com, confirmed on October 20, 2026 that an unauthorized third party had installed malicious programs in some customer environments of its Desktop Cloud service. It began shutting servers down at 4:00 Japan time on October 21, 2026.

BleepingComputer reported on October 21 that up to 26,739 customer servers could be affected and that all Desktop Cloud plans were interrupted with no restart date. ASCII.jp carried the same figure the same day and said GMO urged users to change IDs and passwords stored on their servers.

The number is an upper bound, not a count of confirmed infections. GMO has said the servers are those potentially in scope.

Later updates: data taken, platform will not restart

Later reports from GMO went further than the first notice, and the picture became more serious within days. In its fourth report, per Rescana's timeline updated on October 25, GMO said on October 24 that its investigation confirmed customer information was taken outside the service, and that the current platform will not be restarted.

The same summary says GMO received a money demand from someone it believes is the attacker, will not pay, and has given evidence to police. GMO has not publicly said how the attacker got in, what the malicious programs do, or which data was taken. GMO also says it does not store payment card data on these servers.

Why this matters for B2B software buyers

This is a supply-side risk: a hosted environment you rely on was compromised, and anything stored inside it has to be treated as exposed. The Desktop Cloud service is marketed for running trading tools around the clock, so saved broker logins and sessions are the main concern.

• Credentials live where you least expect: saved browser logins, API keys and VPN profiles on a hosted desktop all become part of the blast radius.
• Shutdowns are business continuity events: workloads stopped for days with no date to return.
• Vendor transparency varies: as of the latest reports, there is no public cause, malware family or indicators of compromise to hunt for.

What to do now: checklist

If you or your clients use this service, act on credentials first and recovery second. For other hosted desktops and VPS providers, use the incident as a prompt to review what is stored where.

1. Rotate every password, API key and token stored on or used from the affected servers, and end active sessions rather than only changing passwords.
2. Scan devices that connected to the service and back up needed data.
3. Check account activity at brokers or connected services for unrecognized actions, and keep records for any compensation claim.
4. Ignore messages that claim to be from the attacker, and treat refund or compensation contacts with suspicion.
5. Rebuild workloads from known-good sources instead of restoring old server images.
6. Enable multi-factor authentication wherever it is offered.

Related SaaSPodium categories

Hosted-environment compromises are best handled with layered controls: endpoint protection to catch malware, vulnerability management to find exposure, and training so staff spot follow-up scams. Browse our Antivirus Software and Vulnerability Management Software categories, and read our guide on antivirus versus EDR for business.

For vendor background, see the provider's corporate site at GMO Internet, and check its own announcements for the latest status, since details may change.

Frequently Asked Questions

Which GMO service was affected by the breach?
The affected service is Onamae.com Desktop Cloud, operated by GMO Internet in Japan. All plans were shut down from October 21, 2026, and GMO says it will not restart the current platform.

How many servers were affected?
GMO reported that up to 26,739 servers could be affected. That figure is the number potentially in scope, not the number confirmed as infected, and later reports have not revised it.

What should customers do after the Desktop Cloud breach?
Rotate every credential stored on or used from the servers, end active sessions, scan connected devices, review account activity and ignore messages from anyone claiming to be the attacker. Follow GMO official notices for compensation steps.